{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-101296", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-09-28T13:07:28.598Z", "datePublished": "2026-10-20T13:45:39.959Z", "dateUpdated": "2026-10-21T06:31:55.233Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-10-21T06:31:55.233Z"}, "title": "Apache Tomcat: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms", "problemTypes": [{"descriptions": [{"description": "CWE-304 Missing critical step in authentication", "lang": "en", "cweId": "CWE-304", "type": "CWE"}]}], "source": {"discovery": "EXTERNAL"}, "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Tomcat", "versions": [{"status": "affected", "version": "11.0.0-M1", "lessThanOrEqual": "11.0.26", "versionType": "semver"}, {"status": "affected", "version": "10.1.0-M1", "lessThanOrEqual": "10.1.60", "versionType": "semver"}, {"status": "affected", "version": "9.0.0.M1", "lessThanOrEqual": "9.0.122", "versionType": "semver"}, {"status": "affected", "version": "8.5.0", "lessThanOrEqual": "8.5.100", "versionType": "semver"}, {"status": "affected", "version": "7.0.0", "lessThanOrEqual": "7.0.109", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"value": "A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI SASL authentication mechanism\u00a0allowed attackers to authenticate without providing the correct password.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.26, from 10.1.0-M1 through 10.1.60, from 9.0.0.M1 through 9.0.122.\n\n\n\nThe following versions were EOL at the time the CVE was created but are known to be affected:\u00a0from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.\u00a0Other unsupported versions may also be affected.\n\n\n\nUsers are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.", "lang": "en", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI SASL authentication mechanism&nbsp;<span>allowed attackers to authenticate without providing the correct password.</span></p><p>This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.26, from 10.1.0-M1 through 10.1.60, from 9.0.0.M1 through 9.0.122.</p><p><span>The following versions were EOL at the time the CVE was created but are known to be affected:</span><span>&nbsp;</span>from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.&nbsp;<span>Other unsupported versions may also be affected.</span></p><p>Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.</p>"}]}], "references": [{"url": "https://lists.apache.org/thread.html/bl52b9go9ckoov8x4v3dt6rkm573cygd", "tags": ["vendor-advisory"]}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "important"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "credits": [{"lang": "en", "value": "Sai Sreewathsa Kovalluri, Shon Babu, and Kannan K of Innspark Solutions Private Limited", "type": "finder"}], "x_generator": {"engine": "Vulnogram 1.0.3"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/10/20/26"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-10-20T18:09:50.320Z"}}, {"metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-10-20T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-101296"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-21T03:56:29.578Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/10/20/26"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-10-20T18:09:50.320Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-101296", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-20T19:23:51.094251Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-20T19:24:35.353Z"}}], "cna": {"title": "Apache Tomcat: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Sai Sreewathsa Kovalluri, Shon Babu, and Kannan K of Innspark Solutions Private Limited"}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "important"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Tomcat", "versions": [{"status": "affected", "version": "11.0.0-M1", "versionType": "semver", "lessThanOrEqual": "11.0.26"}, {"status": "affected", "version": "10.1.0-M1", "versionType": "semver", "lessThanOrEqual": "10.1.60"}, {"status": "affected", "version": "9.0.0.M1", "versionType": "semver", "lessThanOrEqual": "9.0.122"}, {"status": "affected", "version": "8.5.0", "versionType": "semver", "lessThanOrEqual": "8.5.100"}, {"status": "affected", "version": "7.0.0", "versionType": "semver", "lessThanOrEqual": "7.0.109"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://lists.apache.org/thread.html/bl52b9go9ckoov8x4v3dt6rkm573cygd", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.3"}, "descriptions": [{"lang": "en", "value": "A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI SASL authentication mechanism\u00a0allowed attackers to authenticate without providing the correct password.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.26, from 10.1.0-M1 through 10.1.60, from 9.0.0.M1 through 9.0.122.\n\n\n\nThe following versions were EOL at the time the CVE was created but are known to be affected:\u00a0from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.\u00a0Other unsupported versions may also be affected.\n\n\n\nUsers are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.", "supportingMedia": [{"type": "text/html", "value": "<p>A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI SASL authentication mechanism&nbsp;<span>allowed attackers to authenticate without providing the correct password.</span></p><p>This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.26, from 10.1.0-M1 through 10.1.60, from 9.0.0.M1 through 9.0.122.</p><p><span>The following versions were EOL at the time the CVE was created but are known to be affected:</span><span>&nbsp;</span>from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.&nbsp;<span>Other unsupported versions may also be affected.</span></p><p>Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-304", "description": "CWE-304 Missing critical step in authentication"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-10-21T06:31:55.233Z"}}}, "cveMetadata": {"cveId": "CVE-2026-101296", "state": "PUBLISHED", "dateUpdated": "2026-10-21T06:31:55.233Z", "dateReserved": "2026-09-28T13:07:28.598Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2026-10-20T13:45:39.959Z", "assignerShortName": "apache"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Apache Tomcat", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "11.0.26", "status": "affected", "version": "11.0.0-M1", "versionType": "semver"}, {"lessThanOrEqual": "10.1.60", "status": "affected", "version": "10.1.0-M1", "versionType": "semver"}, {"lessThanOrEqual": "9.0.122", "status": "affected", "version": "9.0.0.M1", "versionType": "semver"}, {"lessThanOrEqual": "8.5.100", "status": "affected", "version": "8.5.0", "versionType": "semver"}, {"lessThanOrEqual": "7.0.109", "status": "affected", "version": "7.0.0", "versionType": "semver"}]}], "source": "security@apache.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI SASL authentication mechanism\u00a0allowed attackers to authenticate without providing the correct password.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.26, from 10.1.0-M1 through 10.1.60, from 9.0.0.M1 through 9.0.122.\n\n\n\nThe following versions were EOL at the time the CVE was created but are known to be affected:\u00a0from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.\u00a0Other unsupported versions may also be affected.\n\n\n\nUsers are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue."}], "id": "CVE-2026-101296", "lastModified": "2026-10-21T04:16:58.097", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-101296", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-20T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-10-20T14:16:54.767", "references": [{"source": "security@apache.org", "url": "https://lists.apache.org/thread.html/bl52b9go9ckoov8x4v3dt6rkm573cygd"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/10/20/26"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-304"}], "source": "security@apache.org", "type": "Secondary"}]}

{"affected_release": [{"advisory": "RHSA-2026:81365", "cpe": "cpe:/a:redhat:hummingbird:1", "package": "tomcat11-main-11.0.27-0.1.hum1", "product_name": "Red Hat Hardened Images", "release_date": "2026-10-12T00:00:00Z"}, {"advisory": "RHSA-2026:85926", "cpe": "cpe:/a:redhat:hummingbird:1", "package": "tomcat10-main-10.1.61-0.1.hum1", "product_name": "Red Hat Hardened Images", "release_date": "2026-10-20T00:00:00Z"}], "bugzilla": {"description": "tomcat: tomcat: Authentication bypass via non-GSSAPI SASL in JNDI realm", "id": "2556187", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556187"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "status": "verified"}, "cwe": "CWE-303", "details": ["A flaw was found in Apache Tomcat. When the Java Naming and Directory Interface (JNDI) realm is configured with a non-Generic Security Service Application Program Interface (GSSAPI) Simple Authentication and Security Layer (SASL) mechanism, a missing verification step allows an attacker to bypass authentication without providing the correct password. An unauthenticated remote attacker can exploit this vulnerability to gain unauthorized access to protected resources."], "mitigation": {"lang": "en:us", "value": "--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\nThe highest-value action is to reconfigure Tomcat JNDIRealm to enforce Kerberos GSSAPI authentication and eliminate non-GSSAPI SASL authentication mechanisms: upgrade to Apache Tomcat 11.0.27, 10.1.61, or 9.0.123 (or the fixed Tomcat builds), which verify credentials properly during non-GSSAPI SASL authentication in JNDIRealm, closing unauthenticated request to protected realm using non-GSSAPI SASL credentials. Until patched, this is a concern on Tomcat deployments with JNDIRealm configured with a non-GSSAPI SASL authentication mechanism, so restrict network access to endpoints protected by the JNDI realm and avoid using non-GSSAPI SASL authentication configurations. As a compensating measure, intercept and authenticate inbound requests at an identity-aware gateway before they reach the vulnerable Tomcat JNDI realm. These controls limit blast radius and contain exploitation, but they do not fix the underlying missing critical authentication step defect \u2014 apply the upstream patch to fully remediate.\nHighest-impact CME: CME-201 Zero Trust Gateway / Identity-Aware Proxy (medium)"}, "name": "CVE-2026-101296", "public_date": "2026-10-20T13:45:39Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-101296\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-101296\nhttps://lists.apache.org/thread.html/bl52b9go9ckoov8x4v3dt6rkm573cygd"], "threat_severity": "Important"}