CVE-2026-34486

Analyzed Analyzed - Analysis Complete

Encryption Bypass Vulnerability in Apache Tomcat EncryptInterceptor

Publication date: 2026-04-09

Last updated on: 2026-08-10

Assigner: Apache Software Foundation

Description

Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-09

Last Modified

2026-08-10

Generated

2026-08-15

AI Q&A

2026-04-09

EPSS Evaluated

2026-08-14

NVD

CVE-2026-34486

EUVD

EUVD-2026-21056

Affected Vendors & Products

Vendor	Product	Version / Range
redhat	enterprise_linux	8.0
redhat	enterprise_linux	9.0
redhat	enterprise_linux_tus	8.8
redhat	enterprise_linux_update_services_for_sap_solutions	8.8
redhat	enterprise_linux_update_services_for_sap_solutions	9.2
redhat	enterprise_linux_update_services_for_sap_solutions	9.4
redhat	enterprise_linux	10.0
redhat	enterprise_linux_eus	10.0
redhat	enterprise_linux_update_services_for_sap_solutions	9.6
redhat	enterprise_linux_els	7.0
redhat	jboss_web_server	7.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-807	The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.
CWE-311	The product does not encrypt sensitive or critical information before storage or transmission.

Attack-Flow Graph

Executive Summary

This vulnerability is a Missing Encryption of Sensitive Data issue in Apache Tomcat. It arises due to the fix for a previous vulnerability (CVE-2026-29146) which unintentionally allowed bypassing the EncryptInterceptor, a component responsible for encrypting sensitive data.

Affected versions include Apache Tomcat 11.0.20, 10.1.53, and 9.0.116. The issue is resolved in versions 11.0.21, 10.1.54, and 9.0.117.

Impact Analysis

The vulnerability can lead to sensitive data not being properly encrypted, which increases the risk of data exposure or leakage. Attackers might exploit this to access confidential information that should have been protected by encryption.

Compliance Impact

The vulnerability involves missing encryption of sensitive data in Apache Tomcat, which could potentially lead to exposure of sensitive information.

Since standards like GDPR and HIPAA require protection of sensitive data through encryption and other security measures, this vulnerability could negatively impact compliance with such regulations if exploited.

Users are advised to upgrade to fixed versions to mitigate this risk and maintain compliance.

Mitigation Strategies

Users are recommended to upgrade Apache Tomcat to versions 11.0.21, 10.1.54, or 9.0.117, which contain fixes for this vulnerability.

Hi! I’m here to help you understand CVE-2026-34486. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70