CVE-2026-29146 is a Padding Oracle vulnerability in the EncryptInterceptor component of Apache Tomcat when used with default configuration. It affects a wide range of Apache Tomcat versions from 7.0.100 through 11.0.18. The vulnerability allows attackers to exploit differences in padding error responses to decrypt encrypted data without needing authentication or user interaction. The issue is resolved in Apache Tomcat versions 11.0.19, 10.1.53, and 9.0.116. The CVSS v3.1 score of 7.5 reflects a high severity due to the potential confidentiality impact over a network with low attack complexity.

Successful exploitation of this vulnerability can lead to unauthorized disclosure of sensitive information by exploiting padding oracle side-channel information. There is no impact on integrity or availability. The vulnerability does not require privileges or user interaction to exploit, making it a significant confidentiality risk for affected Apache Tomcat deployments using default configurations.

Users should upgrade affected Apache Tomcat installations to versions 11.0.19, 10.1.53, or 9.0.116, which contain fixes for this vulnerability. No other official remediation or temporary fixes are indicated. Patch status is not explicitly confirmed in the vendor advisory content provided, but the recommendation to upgrade to these versions implies an official fix is available in those releases.