Apache fixes Tomcat JNDI flaw allowing password-free access in versions 7.0 through 11.0

Apache Software Foundation has released patches for a critical authentication bypass in Apache Tomcat. The flaw, tracked as CVE-2026-101296, allows attackers to authenticate without providing correct credentials when specific JNDI realm configurations are used.

What happened

The vulnerability stems from a missing critical step in the authentication process within Apache Tomcat. According to the National Vulnerability Database, this issue arises when the JNDI realm is configured with a non-GSSAPI SASL authentication mechanism. This configuration error allows attackers to bypass password validation entirely.

The flaw impacts a wide range of supported and unsupported versions. Affected releases include Apache Tomcat 11.0.0-M1 through 11.0.26, 10.1.0-M1 through 10.1.60, and 9.0.0.M1 through 9.0.122. Additionally, end-of-life versions 8.5.0 through 8.5.100 and 7.0.0 through 7.0.109 are known to be affected.

The Apache Software Foundation addressed the issue by releasing updated versions. Users are advised to upgrade to Apache Tomcat 11.0.27, 10.1.61, or 9.0.123. These releases contain the necessary fixes to restore proper credential validation. The advisory was posted to the oss-security mailing list on October 20 by Mark Thomas.

Why it matters

The National Vulnerability Database assigns a CVSS score of 9.1 to this flaw, rating it as critical. This high severity reflects the ease with which an attacker can gain unauthorized access. The weakness is categorized under CWE-304, indicating a failure to properly validate authentication credentials.

This incident follows recent stability issues in the same software. As Patch Gazette reported on October 20, Apache Tomcat also released an advisory for incomplete cleanup causing intermittent TLS 1.3 connection failures across versions 9 through 11. That separate issue affected connectivity but did not involve authentication bypass.

The current flaw is distinct because it compromises security rather than availability. Attackers exploiting CVE-2026-101296 can authenticate without valid passwords. This risk applies to any system using the affected JNDI realm configurations with non-GSSAPI SASL mechanisms.

What to watch

• Check if your Tomcat instances use JNDI realms with non-GSSAPI SASL authentication.
• Verify current version numbers against the affected ranges listed in the advisory.
• Monitor logs for successful authentication events that lack corresponding password validation attempts.
• Watch for the availability of patches for end-of-life versions, though none are currently confirmed.

Who needs to act first

Teams should prioritize systems exposed to untrusted networks or handling sensitive data. Identify all instances running affected Tomcat versions and determine their exposure levels. Systems facing the internet require immediate attention. Before applying updates, ensure you have recent backups of configuration files and data. Test the patches in a staging environment to verify compatibility with existing applications. Roll out the fixes in phases, starting with the most critical systems, to minimize disruption. Monitor for any unexpected behavior after the update.

Background: CVSS score

The CVSS score explains vulnerability severity using a 0.0 to 10.0 scale. It measures attack vector, complexity, privileges required, and impact on confidentiality, integrity, and availability. You use this metric to prioritize patches, though you must adjust it for your specific environment to avoid wasting time on irrelevant threats.

Read the full guide: CVSS Score Explained: How to Read Risk Metrics and Prioritize Fixes

What to do and how to stay safe: Apache Tomcat

• Audit your inventory for Apache Tomcat instances using JNDI realms with non-GSSAPI SASL mechanisms.
• Apply the latest available updates for supported versions immediately to close the authentication gap.
• Review access logs for signs of unauthorized authentication attempts during the window of exposure.
• Consider restricting network access to Tomcat services until patches are fully deployed and verified.

Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which Apache Tomcat versions are affected by CVE-2026-101296?

Versions 11.0.0-M1 through 11.0.26, 10.1.0-M1 through 10.1.60, 9.0.0.M1 through 9.0.122, and EOL versions 8.5.0 through 8.5.100 and 7.0.0 through 7.0.109 are affected.

Is there a fix available for this vulnerability?

Yes, users should upgrade to Apache Tomcat 11.0.27, 10.1.61, or 9.0.123, which resolve the authentication bypass issue.

What causes the authentication bypass in this flaw?

The bypass occurs when the JNDI realm is configured with a non-GSSAPI SASL authentication mechanism, allowing attackers to authenticate without providing the correct password.