Multiple Apache Tomcat Vulnerabilities Allow Attackers to Bypass Authentication
\n \t
\n
<\/BR>
\n
\n \t
\n
<\/BR><\/p>\n
The Apache Software Foundation has disclosed two vulnerabilities affecting Apache Tomcat<\/a> that could allow attackers to bypass authentication and security constraints protecting web applications.<\/p>\n The flaws, tracked as CVE-2026-55957 and CVE-2026-55956, impact multiple major versions of the widely deployed servlet container, prompting urgent upgrade recommendations across enterprise environments.<\/p>\n Rated as Important severity, this vulnerability affects<\/a> Tomcat\u2019s JNDIRealm component when configured with GSSAPI authenticated bind. The flaw stems from improperly enforced security constraints on the default servlet, where configured HTTP methods or method omissions within access rules were silently ignored.<\/p>\n This behavior effectively allowed attackers to bypass intended access restrictions and reach protected resources without proper authentication.<\/p>\n Affected versions:<\/strong><\/p>\n Upgrade to Tomcat 11.0.5, 10.1.37, or 9.0.101 or later. The issue was responsibly disclosed by security researcher Ilan Toyter.<\/p>\n The second flaw, rated Moderate, shares the same root cause: security constraints defined for the default servlet failed to properly enforce configured HTTP methods or method omissions. While less severe than CVE-2026-55957<\/a>, this issue affects a broader range of Tomcat releases, indicating the defect persisted across several release cycles before detection.<\/p>\n Affected versions:<\/strong><\/p>\n Fix:<\/strong> Upgrade to Tomcat 11.0.23, 10.1.56, or 9.0.119 or later.<\/p>\n Both vulnerabilities center on Tomcat\u2019s handling of In practice, this meant that endpoints assumed to be protected by method-based rules remained accessible via unrestricted verbs, creating a path for unauthorized access to sensitive resources or administrative functions.<\/p>\n Organizations running affected Tomcat instances should prioritize patching, especially where the default servlet handles sensitive content or where JNDIRealm with GSSAPI bind is used for LDAP-backed authentication<\/a>.<\/p>\n Since the Apache Software Foundation lists no workarounds other than upgrading, applying the patched releases is the only reliable mitigation. Administrators should also audit existing \u00a0Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations.\u00a0-> Integrate ANY.RUN With Your SOC <\/a>Now<\/a><\/strong>.<\/strong><\/p>\n The post Multiple Apache Tomcat Vulnerabilities Allow Attackers to Bypass Authentication<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\nCVE-2026-55957: JNDIRealm Authentication Bypass<\/strong><\/h2>\n
\n
CVE-2026-55956: Default Servlet Constraint Bypass<\/strong><\/h2>\n
\n
<security-constraint><\/code> definitions applied to the default servlet. When administrators scope access control to specific HTTP methods (e.g., restricting PUT<\/code> or DELETE<\/code> while allowing GET<\/code>), Tomcat\u2019s request-matching logic failed to honor those method-level restrictions consistently.<\/p>\nweb.xml<\/code> security constraints post-upgrade to confirm intended access controls now function as designed.<\/p>\n