CVE-2026-34486
Apache Tomcat EncryptInterceptor fail-open bypass in cluster messaging
A bad fix for CVE-2026-29146 let Tomcat's EncryptInterceptor pass messages it failed to decrypt. Only 11.0.20, 10.1.53 and 9.0.116 are affected. Update to 11.0.21, 10.1.54 or 9.0.117. In CISA KEV since 4 August 2026.
By ThreatWire Desk · Published 9 Apr 2026 · Updated 27 Oct 2026
- CVSS
- 7.5
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Class
- RCE
- Status
- Active Exploitation
- KEV
- Listed in CISA KEV
- 0-day
- No
- Vendor
- Apache Software Foundation
- Products
- Apache Tomcat, Apache Tomcat Tribes (tomcat-tribes)
- Affected
- Apache Tomcat 11.0.20, 10.1.53 and 9.0.116 only. Exposure requires a configured cluster (Tribes) with the EncryptInterceptor enabled. Clustering and the EncryptInterceptor are off by default.
- Fixed
- Apache Tomcat 11.0.21, 10.1.54 and 9.0.117 and later. Red Hat ships fixed tomcat and tomcat9 packages (see Red Hat CVE page).
- CWE
- CWE-311
- Published
- 9 Apr 2026
- Updated
- 27 Oct 2026
The status above is the claim. Links do not upgrade it.
CVE-2026-34486 lets an attacker who can reach a Tomcat cluster port slip unencrypted messages past the EncryptInterceptor. Those messages are then deserialized. With a suitable gadget library on the classpath, that becomes remote code execution.
The bug is a regression. The fix for CVE-2026-29146, a padding oracle in the same interceptor, moved one line in the receive path. After that change, a message that failed decryption was logged and then passed on anyway.
Affected: only Apache Tomcat 11.0.20, 10.1.53 and 9.0.116. Fixed in 11.0.21, 10.1.54 and 9.0.117. Apache rates it Important and published no CVSS score.
The 7.5 (High) score comes from CISA's enrichment and Red Hat. It rates confidentiality only. The full vector is in the CVSS field. The Apache record classes it as CWE-311, missing encryption.
Exposure needs a non-default setup. Tomcat must run a Tribes cluster with the EncryptInterceptor configured. The attacker needs network access to the cluster receiver port, 4000 by default. No credentials are needed.
Apache published the advisory on 9 April 2026. The reporter, Bartłomiej Dmitruk of Striga, told Apache on 26 March 2026. Striga published a write-up on 13 April and a lab PoC repository on 11 May.
CISA added the CVE to its KEV catalog on 4 August 2026 (checked 27 October 2026). SOCRadar documented its use against hosts in Taiwan in late April 2026. It reported two confirmed compromises. This record does not reproduce payloads or commands.
Read the full explainer: Tomcat cluster encryption bypass lets attackers run code, CISA lists it.
Sources
- Vendor advisory
- Confirmed PoC
- Repository
- Apache Tomcat 11 security page
- Apache Tomcat 10 security page
- Apache Tomcat 9 security page
- Tomcat fix commit 1fab40cc (11.0.x)
- NVD
- CVE.org record
- CISA KEV catalog
- GitHub Advisory GHSA-69r9-qgr7-g2wj
- Red Hat CVE page
- Striga research by Bartłomiej Dmitruk (13 April 2026)
- SOCRadar, SNOWLIGHT campaign report (31 July 2026)
Related on ThreatWire
- Threat reportTomcat cluster encryption bypass lets attackers run code, CISA lists it
- CVE recordCVE-2026-88900: Camel-JGroups consumer deserializes cluster messages without a filter, leading to code execution
- CVE recordCVE-2026-78165: Camel-Spring-Redis default serializer deserializes Redis payloads without a filter, enabling code execution
- CVE recordCVE-2026-111497: Google Brotli decoder out-of-bounds write bundled in Node.js (Node2Shell)
- CVE recordCVE-2026-7711: MindsDB BYOM upload can execute Python code without authentication
- CVE recordCVE-2026-78164: Camel HTTP producers resolve property placeholders in message-supplied URI headers, exposing secrets
- CVE recordCVE-2026-80312: Camel-OAuth processors fail open, letting requests that failed authentication through
- CVE recordCVE-2026-85251: Camel-HTTP re-sends credentials to whatever host a redirect names