This advisory covers a critical security update for Red Hat Hardened Images RPMs, specifically Apache Tomcat 10 packages. Among the fixed issues is CVE-2026-55955, an improper authentication vulnerability in the EncryptionInterceptor component used for Tribes cluster communication. This vulnerability enables a remote attacker with access to the cluster network to perform replay attacks on encrypted cluster messages, potentially leading to unauthorized access or data manipulation within the cluster. Exploitation requires the EncryptionInterceptor to be enabled, which is a non-default configuration. Red Hat corrected the severity rating from important to moderate due to the adjacency of the attack vector and complexity required. The update includes tomcat10-10.1.56-1.hum1 and related noarch RPMs. No known exploits are reported in the wild. The advisory references multiple CVEs and CWE identifiers related to authentication bypass and access control issues.

The impact is limited to Tomcat deployments using the EncryptionInterceptor for Tribes cluster communication. Successful exploitation could allow an attacker to replay encrypted cluster messages, potentially gaining unauthorized access or manipulating cluster data. However, the attack requires network access to the cluster and a non-default configuration, reducing the overall risk. Red Hat rates the impact as moderate with a CVSS 3.1 vector of AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N (4.2). No known active exploitation has been reported.

Red Hat has released updated RPM packages (tomcat10-10.1.56-1.hum1 and related components) that fix these vulnerabilities. Users should apply these updates to affected Red Hat Hardened Images. Deployments not using Tomcat clustering or not configuring the EncryptionInterceptor are not affected. It is recommended to restrict cluster communication channels to trusted, isolated networks to mitigate potential replay attacks. No additional mitigations are required beyond applying the official update.