Update Tomcat 9-11 immediately to fix CVE-2026-101296 JNDI realm SASL auth bypass critical flaw

Attackers can now bypass password requirements in Apache Tomcat to gain unauthorized access to web applications. This capability exists when the server uses a Java Naming and Directory Interface realm configured with specific Simple Authentication and Security Layer mechanisms. The flaw allows an intruder to authenticate without presenting valid credentials, effectively skipping the security check that should block them.

The vulnerability, identified as CVE-2026-101296, carries a CVSS score of 9.1, which the National Vulnerability Database rates as Critical. According to the advisory posted by Mark Thomas on October 20 on the oss-security mailing list, the issue stems from a missing validation step during the authentication process. This omission permits the server to accept connections that lack proper proof of identity, granting the attacker the same level of access as a legitimate user.

Context and Background

This authentication flaw affects how Apache Tomcat handles identity verification for directory-based realms. When configured to use SASL mechanisms other than Generic Security Services Application Program Interface, the server fails to verify the provided credentials correctly. Instead of rejecting invalid attempts, the system treats the connection as authenticated. This behavior creates a direct path for unauthorized entry into protected resources managed by the application server.

As Shell Bulletin reported on October 20, Apache Tomcat 11 also faces risks from a separate buffer under-read flaw in the AJP protocol that leaks data between requests. That issue, distinct from the current authentication bypass, highlights the need for comprehensive updates across the platform to prevent both data exposure and unauthorized access.

Who Is Affected

The flaw impacts a wide range of Apache Tomcat versions currently in use or previously supported. Affected releases include version 11.0.0-M1 through 11.0.26, version 10.1.0-M1 through 10.1.60, and version 9.0.0.M1 through 9.0.122. These are the primary branches where users are expected to apply security updates to maintain operational integrity and compliance with security standards.

Older, end-of-life versions are also vulnerable. The advisory confirms that version 8.5.0 through 8.5.100 and version 7.0.0 through 7.0.109 contain this defect. Although these branches no longer receive official support, many small businesses and legacy systems may still rely on them. Users of these unsupported versions must evaluate their exposure carefully, as no new patches will be issued for them.

What to watch

Administrators should prioritize upgrading to the patched versions immediately. The Apache Software Foundation has released version 11.0.27, version 10.1.61, and version 9.0.123 to resolve this specific authentication bypass. These updates restore the necessary validation steps that prevent unauthorized logins. For environments running end-of-life versions, migration to a supported branch is the only confirmed method to eliminate this risk.

What made it possible

This incident illustrates a common class of authentication flaws where validation logic is incomplete or bypassed. Attackers exploit these gaps to skip credential checks, gaining access without knowing passwords. In intrusion terms, this serves as an initial access vector, allowing threat actors to enter systems that should remain locked. Teams usually encounter this when configurations rely on complex protocols that fail to enforce strict identity verification. Check whether your systems enforce mandatory credential validation for all authentication methods to prevent similar bypasses.

What to do and how to stay safe: Apache Tomcat

• Inventory all Apache Tomcat instances to identify versions 7.0 through 11.0 and check if they use JNDI realms with non-GSSAPI SASL mechanisms.
• Upgrade supported servers to Apache Tomcat 11.0.27, 10.1.61, or 9.0.123 to apply the official fix for the authentication bypass.
• Review access logs for suspicious login attempts that succeeded without standard credential prompts, which may indicate exploitation.
• Plan to migrate any end-of-life versions 8.5 or 7.0 to a supported release, as no patches will be provided for these branches.

Step-by-step guide: How Security Advisories Drive Patch Decisions and Reduce Risk

General security guidance from the Shell Bulletin newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which Apache Tomcat versions are vulnerable to CVE-2026-101296?

Versions 11.0.0-M1 through 11.0.26, 10.1.0-M1 through 10.1.60, 9.0.0.M1 through 9.0.122, 8.5.0 through 8.5.100, and 7.0.0 through 7.0.109 are affected.

Is there a patch available for this vulnerability?

Yes, patches are available in Apache Tomcat 11.0.27, 10.1.61, and 9.0.123.

What severity rating does CVE-2026-101296 have?

The National Vulnerability Database rates it as Critical with a CVSS score of 9.1.