CVE-2026-68569

Analyzed Analyzed - Analysis Complete

Improper Authentication in Apache Tomcat

Publication date: 2026-08-25

Last updated on: 2026-08-27

Assigner: Apache Software Foundation

Description

Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances (e.g. CLIENT-CERT, SPNEGO) that a user would be authenticated even if the user did not exist in the DataSourceRealm. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-25

Last Modified

2026-08-27

Generated

2026-09-15

AI Q&A

2026-08-26

EPSS Evaluated

2026-09-13

NVD

CVE-2026-68569

EUVD

EUVD-2026-66135

Affected Vendors & Products

Vendor	Product	Version / Range
apache	tomcat	From 7.0.0 (inc) to 7.0.109 (inc)
apache	tomcat	From 10.1.0 (inc) to 10.1.58 (exc)
apache	tomcat	From 11.0.0 (inc) to 11.0.25 (exc)
apache	tomcat	From 8.5.0 (inc) to 9.0.121 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

This vulnerability in Apache Tomcat allows authentication to occur even when a user does not exist in the DataSourceRealm. This happens under specific authentication methods like CLIENT-CERT or SPNEGO, potentially granting unauthorized access.

Detection Guidance

This vulnerability involves improper authentication in Apache Tomcat, particularly with CLIENT-CERT or SPNEGO mechanisms. Detection requires checking Tomcat versions and configuration files for DataSourceRealm usage. No direct commands are provided in the context, but you should verify Tomcat versions against affected releases and review authentication logs for unauthorized access attempts.

Impact Analysis

An attacker could exploit this to gain unauthorized access to the system by bypassing authentication checks. This may lead to data breaches, unauthorized actions, or further compromise of the system.

Compliance Impact

This vulnerability could violate compliance requirements by allowing unauthorized access to sensitive data, potentially leading to legal penalties, loss of trust, and failure to meet data protection standards like GDPR or HIPAA.

Mitigation Strategies

Upgrade Apache Tomcat to version 11.0.25, 10.1.58, or 9.0.121 to fix the improper authentication vulnerability.

Hi! I’m here to help you understand CVE-2026-68569. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70