This vulnerability in Apache Tomcat arises from a bypass in the EncryptInterceptor, a mechanism designed to enforce encryption of sensitive data. The bypass was introduced inadvertently by a prior fix for CVE-2026-29146. As a result, sensitive data may remain unencrypted, potentially exposing confidential information. The issue affects Apache Tomcat versions 11.0.20, 10.1.53, and 9.0.116. Red Hat's advisory confirms the vulnerability impacts their Red Hat Enterprise Linux and JBoss Web Server products that use these Tomcat versions. The CVSS v3.1 base score is 7.5 (high severity) with network attack vector, low complexity, no privileges required, and no user interaction needed. The impact is high confidentiality loss without integrity or availability impact. Red Hat states no suitable mitigation other than upgrading is currently available. Fixed versions are 11.0.21, 10.1.54, and 9.0.117.

The vulnerability allows attackers to bypass the EncryptInterceptor, resulting in sensitive data being transmitted or stored without encryption. This leads to a high confidentiality impact, potentially exposing sensitive information to unauthorized parties. There is no impact on integrity or availability. The flaw affects Apache Tomcat deployments including Red Hat Enterprise Linux and JBoss Web Server environments. Exploitation does not require privileges or user interaction and can be performed remotely over the network.

A fix is available by upgrading Apache Tomcat to versions 11.0.21, 10.1.54, or 9.0.117. Red Hat advisories recommend applying these updates to affected products. Currently, no effective mitigation other than upgrading meets Red Hat's criteria for ease of use, applicability, and stability. Users should prioritize upgrading to the fixed versions to remediate this vulnerability.