CVE-2026-55276 is an Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat that causes the effective web.xml configuration logged by the server to be incomplete. The flaw omits special roles and empty authorization constraints from the logged output, potentially hiding authorization constraints from audit logs. This affects Apache Tomcat versions from 8.5.0 through 8.5.100, 9.0.0 through 9.0.118, 10.1.0 through 10.1.55, and 11.0.0 through 11.0.22. The issue is resolved by upgrading to versions 8.5.101, 9.0.119, 10.1.56, or 11.0.23. The vendor advisory from Ubuntu confirms the availability of patches and recommends standard system updates or Ubuntu Pro ESM for fixes.

The vulnerability causes incomplete logging of the effective web.xml configuration, specifically omitting special roles and empty authorization constraints. This reduces the ability to audit authorization settings accurately, potentially allowing attackers or administrators to hide authorization constraints from logs. There is no indication that this directly enables unauthorized access or code execution, but it impacts security monitoring and audit capabilities.

A fix is available. Users should upgrade Apache Tomcat to versions 8.5.101, 9.0.119, 10.1.56, or 11.0.23 or later. Ubuntu users can apply the patches via standard system updates or through Ubuntu Pro Extended Security Maintenance (ESM) channels as detailed in the Ubuntu advisory USN-8551-1. No additional mitigation steps are required beyond applying the official patches.