This vulnerability arises from a bypass in the EncryptInterceptor component of Apache Tomcat, introduced as a side effect of the fix for CVE-2026-29146. The EncryptInterceptor is responsible for encrypting sensitive data, and the bypass allows this data to remain unencrypted, leading to potential information disclosure. The flaw affects multiple Apache Tomcat versions including 9.0.116, 10.1.53, and 11.0.20. Red Hat has issued advisories and security updates addressing this issue, recommending upgrades to versions 9.0.117, 10.1.54, and 11.0.21 respectively. The vulnerability is categorized under CWE-311 (Missing Encryption of Sensitive Data) and CWE-807 (Reliance on Untrusted Inputs in a Security Decision). The CVSS v3 score assigned by Red Hat is 7.5 (High), with an attack vector of network, low attack complexity, no privileges required, and no user interaction needed. The impact is primarily confidentiality loss due to unencrypted sensitive data exposure. No mitigations other than upgrading are currently considered effective or meeting Red Hat's criteria for ease of deployment and stability.

The vulnerability allows attackers to bypass the EncryptInterceptor, resulting in sensitive data not being encrypted as intended. This can lead to information disclosure in affected Apache Tomcat environments, including Red Hat Enterprise Linux and Red Hat JBoss Web Server deployments. The impact is limited to confidentiality loss; integrity and availability are not affected. The vulnerability can be exploited remotely without authentication or user interaction, increasing the risk of exposure. No known exploits in the wild have been reported to date.

A fix is available and users are strongly advised to upgrade affected Apache Tomcat versions to 9.0.117, 10.1.54, or 11.0.21 or later. According to the Red Hat advisory, no other mitigations meet their criteria for ease of use, applicability, or stability. Therefore, applying the official patch or upgrading to the fixed versions is the recommended and effective mitigation.