The Red Hat security advisory RHSA-2026:16528 updates multiple Apache Tomcat 10 RPM packages in Red Hat Hardened Images to address several vulnerabilities including CVE-2026-43512. This CVE describes an authentication bypass vulnerability in Apache Tomcat's DIGEST authentication mechanism, where any unknown user can authenticate by submitting the password 'null'. Although this allows bypassing authentication controls, the unknown user does not gain roles or impersonate existing users, limiting the impact. Red Hat notes that DIGEST authentication is not commonly enabled by default in production environments. The advisory recommends disabling DIGEST authentication if it is not essential. The update includes new RPM versions of tomcat10 packages but does not explicitly confirm a patch status. No active exploitation is known.

The authentication bypass vulnerability (CVE-2026-43512) allows remote attackers to authenticate as unknown users if DIGEST authentication is enabled, potentially gaining unauthorized access to applications protected by this method. However, since the unknown user is not mapped to any valid roles, the actual access gained is limited by application authorization constraints. There is no credential theft or impersonation of existing users. The impact is medium severity due to the limited access and the uncommon use of DIGEST authentication in production.

Red Hat recommends disabling DIGEST authentication in Apache Tomcat if it is not essential to your environment. This involves modifying the server's authentication configuration to use alternative methods and restarting the service. The advisory includes updated RPM packages for tomcat10, which should be applied to incorporate the fixes and enhancements. Patch status is not explicitly confirmed; check the vendor advisory for the latest remediation guidance. No urgent action is required if DIGEST authentication is not used.