This vulnerability in Apache Tomcat arises from a bypass of the EncryptInterceptor component, which is responsible for encrypting sensitive data. The bypass was introduced inadvertently when fixing a prior vulnerability (CVE-2026-29146). As a result, sensitive data that should be encrypted may be transmitted or stored in plaintext, increasing the risk of data exposure. The issue affects Apache Tomcat versions 11.0.20, 10.1.53, and 9.0.116. Red Hat and Apache have released updated versions (11.0.21, 10.1.54, and 9.0.117) that address this problem. The CVSS v3.1 base score is 7.5, indicating a high severity with network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality impact but no integrity or availability impact.

The vulnerability allows an attacker to obtain sensitive data in unencrypted form due to the bypass of the encryption mechanism in Apache Tomcat. This can lead to exposure of confidential information, potentially compromising data confidentiality. There is no impact on data integrity or availability. No known exploits in the wild have been reported at this time.

A fix is available. Users should upgrade Apache Tomcat to versions 11.0.21, 10.1.54, or 9.0.117 or later to remediate this vulnerability. The vendor advisory from Red Hat confirms the availability of these updates and recommends applying them. No additional mitigation steps are indicated beyond applying the official patches.