This vulnerability in Apache Tomcat arises from a regression caused by the fix for CVE-2026-29146, which inadvertently allows the EncryptInterceptor to be bypassed. As a result, sensitive data that should be encrypted may be transmitted or stored without encryption, violating security best practices and potentially exposing confidential information. The affected versions are 11.0.20, 10.1.53, and 9.0.116. The Apache Software Foundation has addressed this issue in subsequent releases 11.0.21, 10.1.54, and 9.0.117.

The vulnerability has a CVSS score of 7.5 (high severity) with a vector indicating network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact but no integrity or availability impact. This means an unauthenticated attacker can remotely exploit the vulnerability to access sensitive data in unencrypted form, potentially leading to data disclosure. There are no known exploits in the wild at this time.

Users should upgrade Apache Tomcat to versions 11.0.21, 10.1.54, or 9.0.117, which contain the fix for this vulnerability. Since this is an official fix provided by the vendor, applying the update is the recommended remediation. Patch status is confirmed by the vendor advisory information embedded in the description.