---
id: "CVE-2026-55957"
kind: "vulnerability"
aliases: ["CVE-2026-55957", "GHSA-7895-gffq-w6jq"]
title: "Apache Tomcat has a Missing Critical Step in Authentication vulnerability"
severity: "high"
cvss: 7.3
epss: 0.02855
exploited: false
status: "open"
category: "package"
products: [{"name": "org.apache.tomcat.embed:tomcat-embed-core", "fixed": ["11.0.5"], "affected": ">= 11.0.0-M1, < 11.0.5", "ecosystem": "maven"}, {"name": "org.apache.tomcat.embed:tomcat-embed-core", "fixed": ["10.1.37"], "affected": ">= 10.1.0-M1, < 10.1.37", "ecosystem": "maven"}, {"name": "org.apache.tomcat.embed:tomcat-embed-core", "fixed": ["9.0.101"], "affected": ">= 9.0.0.M1, < 9.0.101", "ecosystem": "maven"}, {"name": "org.apache.tomcat.embed:tomcat-embed-core", "fixed": [], "affected": ">= 8.5.0, <= 8.5.100", "ecosystem": "maven"}, {"name": "org.apache.tomcat.embed:tomcat-embed-core", "fixed": [], "affected": "<= 7.0.109", "ecosystem": "maven"}, {"name": "org.apache.tomcat:tomcat", "fixed": ["11.0.5"], "affected": ">= 11.0.0-M1, < 11.0.5", "ecosystem": "maven"}, {"name": "org.apache.tomcat:tomcat", "fixed": ["10.1.37"], "affected": ">= 10.1.0-M1, < 10.1.37", "ecosystem": "maven"}, {"name": "org.apache.tomcat:tomcat", "fixed": ["9.0.101"], "affected": ">= 9.0.0.M1, < 9.0.101", "ecosystem": "maven"}, {"name": "org.apache.tomcat:tomcat", "fixed": [], "affected": ">= 8.5.0, <= 8.5.100", "ecosystem": "maven"}, {"name": "org.apache.tomcat:tomcat", "fixed": [], "affected": "<= 7.0.109", "ecosystem": "maven"}, {"name": "org.apache.tomcat:tomcat-catalina", "fixed": ["11.0.5"], "affected": ">= 11.0.0-M1, < 11.0.5", "ecosystem": "maven"}, {"name": "org.apache.tomcat:tomcat-catalina", "fixed": ["10.1.37"], "affected": ">= 10.1.0-M1, < 10.1.37", "ecosystem": "maven"}, {"name": "org.apache.tomcat:tomcat-catalina", "fixed": ["9.0.101"], "affected": ">= 9.0.0.M1, < 9.0.101", "ecosystem": "maven"}, {"name": "org.apache.tomcat:tomcat-catalina", "fixed": [], "affected": ">= 8.5.0, <= 8.5.100", "ecosystem": "maven"}, {"name": "org.apache.tomcat:tomcat-catalina", "fixed": [], "affected": "<= 7.0.109", "ecosystem": "maven"}, {"name": "apache tomcat", "fixed": ["9.0.101"], "affected": "< 9.0.101", "ecosystem": "vendor"}, {"name": "apache tomcat", "fixed": ["10.1.37"], "affected": ">= 10.1.0, < 10.1.37", "ecosystem": "vendor"}, {"name": "apache tomcat", "fixed": ["11.0.5"], "affected": ">= 11.0.0, < 11.0.5", "ecosystem": "vendor"}]
ecosystems: ["maven", "vendor"]
tags: ["apache-tomcat", "cwe-304", "java", "maven", "package", "self-hosted"]
not_affected_if: ["no-gssapi-bind", "no-jndirealm", "other-auth-realm"]
published_at: "2026-06-29T21:16:45+00:00"
first_seen_at: "2026-11-04T16:24:14+00:00"
updated_at: "2026-11-04T16:28:16+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-7895-gffq-w6jq", "first_seen_at": "2026-11-04T16:24:14+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55957", "first_seen_at": "2026-11-04T16:28:16+00:00"}]
---

# Apache Tomcat has a Missing Critical Step in Authentication vulnerability

When Apache Tomcat's JNDIRealm is configured to authenticate binds using GSSAPI, an attacker can log in without knowing the correct password. The flaw is a missing authentication step in that code path.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- maven:org.apache.tomcat.embed:tomcat-embed-core affected >= 11.0.0-M1, < 11.0.5 fixed 11.0.5
- maven:org.apache.tomcat.embed:tomcat-embed-core affected >= 10.1.0-M1, < 10.1.37 fixed 10.1.37
- maven:org.apache.tomcat.embed:tomcat-embed-core affected >= 9.0.0.M1, < 9.0.101 fixed 9.0.101
- maven:org.apache.tomcat.embed:tomcat-embed-core affected >= 8.5.0, <= 8.5.100 fixed ?
- maven:org.apache.tomcat.embed:tomcat-embed-core affected <= 7.0.109 fixed ?
- maven:org.apache.tomcat:tomcat affected >= 11.0.0-M1, < 11.0.5 fixed 11.0.5
- maven:org.apache.tomcat:tomcat affected >= 10.1.0-M1, < 10.1.37 fixed 10.1.37
- maven:org.apache.tomcat:tomcat affected >= 9.0.0.M1, < 9.0.101 fixed 9.0.101
- maven:org.apache.tomcat:tomcat affected >= 8.5.0, <= 8.5.100 fixed ?
- maven:org.apache.tomcat:tomcat affected <= 7.0.109 fixed ?
- maven:org.apache.tomcat:tomcat-catalina affected >= 11.0.0-M1, < 11.0.5 fixed 11.0.5
- maven:org.apache.tomcat:tomcat-catalina affected >= 10.1.0-M1, < 10.1.37 fixed 10.1.37
- maven:org.apache.tomcat:tomcat-catalina affected >= 9.0.0.M1, < 9.0.101 fixed 9.0.101
- maven:org.apache.tomcat:tomcat-catalina affected >= 8.5.0, <= 8.5.100 fixed ?
- maven:org.apache.tomcat:tomcat-catalina affected <= 7.0.109 fixed ?
- vendor:apache tomcat affected < 9.0.101 fixed 9.0.101
- vendor:apache tomcat affected >= 10.1.0, < 10.1.37 fixed 10.1.37
- vendor:apache tomcat affected >= 11.0.0, < 11.0.5 fixed 11.0.5

## How to check

- Check the Tomcat version with `catalina.sh version` or the `tomcat-embed-core` version in your Maven or Gradle dependencies.
- Look in `conf/server.xml` or `context.xml` for a `JNDIRealm` element that uses GSSAPI bind authentication.

## Fix

- Apache Tomcat 11.x: upgrade to `11.0.5`
- Apache Tomcat 10.1.x: upgrade to `10.1.37`
- Apache Tomcat 9.0.x: upgrade to `9.0.101`
- Apache Tomcat 8.5.x and 7.0.x: unknown; the sources list no fixed version for these branches

## Timeline

- 2026-11-04T16:24:14+00:00 ghsa https://github.com/advisories/GHSA-7895-gffq-w6jq
- 2026-11-04T16:28:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-55957

## Documents

- [advisory] Vendor advisory: lists.apache.org https://lists.apache.org/thread/7fk339o5jvd4mcgsf0chbrn4o525ccjh
- [advisory] Third-party advisory: www.openwall.com http://www.openwall.com/lists/oss-security/2026/06/29/26
- [fix] Patch: github.com https://github.com/apache/tomcat/commit/0cd21c0393b8811af22daddbba7b4e7328e2d79e
- [fix] Patch: github.com https://github.com/apache/tomcat/commit/c32bbd37ea9ee0aaab848af4ee1c9a76e84240ea
- [fix] Patch: github.com https://github.com/apache/tomcat/commit/fd96ab415631eea44636c94f911dd38427070ef9

## From the sources

Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without providing the correct password.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.4, from 10.1.0-M1 through 10.1.36, from 9.0.0.M1 through 9.0.100, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.

Users are recommended to upgrade to version 11.0.5, 10.1.37 or 9.0.101, which fixes the issue.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_