Authentication Bypass in Apache Tomcat via JNDIRealm GSSAPI

Publication date: 2026-06-29

Last updated on: 2026-06-29

Assigner: Apache Software Foundation

Description

Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.4, from 10.1.0-M1 through 10.1.36, from 9.0.0.M1 through 9.0.100, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Users are recommended to upgrade to version 11.0.5, 10.1.37 or 9.0.101, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-29

Last Modified

2026-06-29

Generated

2026-06-30

AI Q&A

2026-06-30

EPSS Evaluated

N/A

NVD

CVE-2026-55957

Affected Vendors & Products

Vendor	Product	Version / Range
apache	tomcat	From 11.0.0-M1 (inc) to 11.0.4 (inc)
apache	tomcat	From 10.1.0-M1 (inc) to 10.1.36 (inc)
apache	tomcat	From 9.0.0.M1 (inc) to 9.0.100 (inc)
apache	tomcat	From 8.5.0 (inc) to 8.5.100 (inc)
apache	tomcat	From 7.0.0 (inc) to 7.0.109 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-304	The product implements an authentication technique, but it skips a step that weakens the technique.

Attack-Flow Graph

Executive Summary

This vulnerability is a Missing Critical Step in Authentication in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI. It allowed attackers to authenticate without providing the correct password.

Impact Analysis

Because attackers can authenticate without the correct password, this vulnerability can allow unauthorized access to systems using Apache Tomcat with the affected configurations. This could lead to unauthorized data access, privilege escalation, and potential compromise of the affected server.

Mitigation Strategies

Users are recommended to upgrade Apache Tomcat to version 11.0.5, 10.1.37, or 9.0.101, which fixes the issue.

Hi! I’m here to help you understand CVE-2026-55957. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70