CVE-2026-29146 identifies a Padding Oracle vulnerability in the EncryptInterceptor component of Apache Tomcat. This vulnerability arises from weaknesses in the encryption padding mechanism used by EncryptInterceptor in its default configuration, potentially allowing remote attackers to decrypt sensitive data. The affected versions span multiple major releases of Apache Tomcat: from 7.0.100 to 7.0.109, 8.5.38 to 8.5.100, 9.0.13 to 9.0.115, 10.0.0-M1 to 10.1.52, and 11.0.0-M1 to 11.0.18. Red Hat's advisory clarifies that this vulnerability is not exploitable in their supported products due to the lack of support for Tomcat clustering, which is the feature that uses EncryptInterceptor. Mitigation can be achieved by removing the catalina-tribes.jar file from the Tomcat installation if clustering is not required, noting that enabling clustering after this removal may cause service errors. Official fixes are available in Apache Tomcat versions 11.0.19, 10.1.53, and 9.0.116. The CVSS v3.1 base score is 7.5 (high severity), reflecting network attack vector, low complexity, no privileges or user interaction required, unchanged scope, and high confidentiality impact without integrity or availability impact.

The vulnerability allows a remote attacker to decrypt sensitive information by exploiting the padding oracle weakness in the EncryptInterceptor component of Apache Tomcat. This compromises confidentiality but does not affect integrity or availability. Red Hat products are not vulnerable in practice because Tomcat clustering is unsupported and untested in their distributions, effectively mitigating the risk in those environments.

Red Hat advises that this vulnerability is not exploitable in their supported products due to the lack of support for Tomcat clustering. For environments where Tomcat clustering is not used, the vulnerability can be mitigated by removing the affected jar file (catalina-tribes.jar) from the Tomcat installation. This can be done by stopping the Tomcat service, deleting the jar file, and restarting the service. If clustering is enabled, it should be disabled before applying this mitigation to avoid service errors. Additionally, upgrading to Apache Tomcat versions 11.0.19, 10.1.53, or 9.0.116, which include the official fix, is recommended.