This vulnerability (CVE-2026-42498) in Apache Tomcat involves the exposure of the HTTP Authentication Header to unintended hosts during the WebSocket authentication process. It affects versions 11.0.0-M1 through 11.0.21, 10.1.0-M1 through 10.1.54, 9.0.2 through 9.0.117, 8.5.24 through 8.5.100, and 7.0.83 through 7.0.109. The exposure could allow unauthorized parties to gain access to sensitive authentication headers, potentially compromising confidentiality and integrity. The vulnerability is tracked under CWE-200 (Exposure of Sensitive Information). Users are advised to upgrade to Apache Tomcat versions 11.0.22, 10.1.55, or 9.0.118 where the issue is fixed.

The vulnerability allows unauthorized disclosure of HTTP Authentication Headers during WebSocket authentication, which may lead to information leakage. The CVSS v3.1 base score of 7.3 reflects a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability. This could enable attackers to gain sensitive authentication information, potentially facilitating further attacks.

A fix is available. Users should upgrade Apache Tomcat to version 11.0.22, 10.1.55, or 9.0.118 to remediate this vulnerability. There is no indication that temporary mitigations or workarounds are provided. Patch status is confirmed by the vendor advisory recommending these upgraded versions.