CVE-2026-101296
Received Received - Intake

Authentication Bypass in Apache Tomcat JNDI Realm

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: Apache Software Foundation

Description
A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI SASL authentication mechanism allowed attackers to authenticate without providing the correct password. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.26, from 10.1.0-M1 through 10.1.60, from 9.0.0.M1 through 9.0.122. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-101296
EUVD
EUVD-2026-105010

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
Apache Software Foundation Apache Tomcat 11.0.0-M1
Apache Software Foundation Apache Tomcat 10.1.0-M1
Apache Software Foundation Apache Tomcat 9.0.0.M1
Apache Software Foundation Apache Tomcat 8.5.0
Apache Software Foundation Apache Tomcat 7.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-304 The product implements an authentication technique, but it skips a step that weakens the technique.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Apache Tomcat occurs when the JNDI realm is configured with a non-GSSAPI SASL authentication mechanism. It allows attackers to bypass password checks and authenticate without providing the correct credentials.

Impact Analysis

Attackers could gain unauthorized access to Tomcat applications, potentially leading to data breaches, privilege escalation, or further network compromise. Systems using affected Tomcat versions are at risk.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements like GDPR (data protection) or HIPAA (health information security). Organizations must patch to maintain compliance.

Mitigation Strategies

Upgrade Apache Tomcat to version 11.0.27, 10.1.61, or 9.0.123, which fix the issue. If using unsupported versions like 8.5.x or 7.0.x, upgrade to a supported version immediately.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-101296. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart