CVE-2026-55957

Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.4, from 10.1.0-M1 through 10.1.36, from 9.0.0.M1 through 9.0.100, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Users are recommended to upgrade to version 11.0.5, 10.1.37 or 9.0.101, which fixes the issue.

CVSS 3.1

7.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

EPSS

2.9% chance of exploitation in the next 30 days; higher than 86% of CVEs (scores of 2026-10-25)

CWE

CWE-304

Published

2026-06-29

Modified

2026-10-25

Record from

the NVD, synced 2026-10-25

Affected

• apache:tomcat

References

• https://lists.apache.org/thread/7fk339o5jvd4mcgsf0chbrn4o525ccjh
• http://www.openwall.com/lists/oss-security/2026/06/29/26

Check your stackJSON