CVE-2026-34487
Sensitive Data Exposure via Log Injection in Apache Tomcat Clustering
Publication date: 2026-04-09
Last updated on: 2026-04-14
Assigner: Apache Software Foundation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| apache | tomcat | From 10.1.0 (inc) to 10.1.54 (exc) |
| apache | tomcat | From 11.0.0 (inc) to 11.0.21 (exc) |
| apache | tomcat | From 9.0.13 (inc) to 9.0.117 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-532 | The product writes sensitive information to a log file. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability involves the insertion of sensitive information into a log file within the cloud membership for the clustering component of Apache Tomcat.
Specifically, it exposes the Kubernetes bearer token, which is a sensitive credential used for authentication.
The issue affects Apache Tomcat versions from 11.0.0-M1 through 11.0.20, 10.1.0-M1 through 10.1.53, and 9.0.13 through 9.0.116.
Users are advised to upgrade to fixed versions 11.0.21, 10.1.54, or 9.0.117 to resolve this issue.
How can this vulnerability impact me? :
The exposure of the Kubernetes bearer token in log files can lead to unauthorized access to Kubernetes clusters.
Attackers who gain access to these logs could use the token to impersonate legitimate users or services, potentially leading to data breaches or unauthorized control over cloud resources.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, users are recommended to upgrade Apache Tomcat to versions 11.0.21, 10.1.54, or 9.0.117, which contain the fix for the issue.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability involves the insertion of sensitive information, specifically the Kubernetes bearer token, into log files. Exposure of such sensitive tokens can lead to unauthorized access risks within Kubernetes environments.
While the provided information does not explicitly mention compliance with standards like GDPR or HIPAA, the exposure of sensitive authentication tokens in logs could potentially lead to violations of data protection and security requirements mandated by these regulations.