VYPR
← All advisories
High severity7.3NVD Advisory· Published Jun 29, 2026· Updated Jul 2, 2026

CVE-2026-55957

CVE-2026-55957

Description

Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.4, from 10.1.0-M1 through 10.1.36, from 9.0.0.M1 through 9.0.100, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.

Users are recommended to upgrade to version 11.0.5, 10.1.37 or 9.0.101, which fixes the issue.

Affected products

4
  • Apache/Tomcatinferred3 versions
    >=7.0.0,<7.0.109+ 2 more
    • (no CPE)range: >=7.0.0,<7.0.109
    • cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*range: <9.0.101
    • (no CPE)range: from 11.0.0-M1 through 11.0.4, from 10.1.0-M1 through 10.1.36, from 9.0.0.M1 through 9.0.100, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109
  • osv-coords
    pkg:bitnami/tomcat
    Range: < 9.0.101

Patches

Vulnerability mechanics

References

2

News mentions

4