This vulnerability (CVE-2026-34487) involves the insertion of sensitive information, specifically the Kubernetes bearer token, into log files by the cloud membership component used for clustering in Apache Tomcat. Affected versions include 11.0.0-M1 through 11.0.20, 10.1.0-M1 through 10.1.53, and 9.0.13 through 9.0.116. The exposure of bearer tokens in logs can lead to unauthorized access if attackers obtain these logs. The Apache Software Foundation has addressed this issue in Apache Tomcat versions 11.0.21, 10.1.54, and 9.0.117. The CVSS v3.1 base score is 7.5, reflecting high impact on confidentiality with no impact on integrity or availability. No known exploits in the wild have been reported at this time.

The vulnerability allows sensitive Kubernetes bearer tokens to be exposed in log files, which could lead to unauthorized access to Kubernetes resources if an attacker gains access to these logs. The confidentiality impact is high, while integrity and availability are not affected. Since the vulnerability can be exploited remotely without privileges or user interaction, it poses a significant risk in environments where affected Apache Tomcat versions are used with the cloud membership clustering component.

A fix is available. Users should upgrade Apache Tomcat to versions 11.0.21, 10.1.54, or 9.0.117, depending on their current version series. No other mitigation steps are specified. Patch status is confirmed by the vendor advisory recommending these upgrades.