Skip to main content
Threat Radar animated logo
EPSS 2.9%top 14%

Apache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bind (CVE-2026-55957)

0
High
VulnerabilityCVE-2026-55957gcveosvubuntu-cve-2026-55957ubuntu-pro-14-04-ltsubuntu-pro-16-04-ltsubuntu-pro-18-04-ltsubuntu-pro-20-04-ltsubuntu-pro-22-04-ltsubuntu-pro-24-04-ltsubuntu-25-10ubuntu-26-04-ltsubuntu-24-04-ltsbit-tomcat-2026-55957cve-2026-55957bitnami
Published: 07/06/2026 (07/06/2026, 16:18:16 UTC)
Source: GCVE Database
Product: tomcat

Description

A vulnerability in Apache Tomcat's JNDIRealm component allows authentication bypass when configured to use GSSAPI authenticated binds. This flaw permits attackers to authenticate without providing the correct password. The issue affects multiple versions across Tomcat 7, 8.5, 9, 10.1, and 11 branches. Fixed versions include 11.0.5, 10.1.37, and 9.0.101. Users are advised to upgrade to these fixed versions to mitigate the risk.

Affected software

Ubuntu:Pro:14.04:LTSmore threats →ghsa
tomcat6
pkg:deb/ubuntu/[email protected]+esm3?arch=source&distro=esm-infra-legacy/trusty
Affected versions
=6.0.37-1=6.0.39-1=6.0.39-1ubuntu0.1=6.0.39-1ubuntu0.1+esm1=6.0.39-1ubuntu0.1+esm2=6.0.39-1ubuntu0.1+esm3
Ubuntu:Pro:14.04:LTSmore threats →ghsa
tomcat7
pkg:deb/ubuntu/[email protected]+esm2?arch=source&distro=esm-infra-legacy/trusty
Affected versions
=7.0.42-1=7.0.47-1=7.0.50-1=7.0.52-1=7.0.52-1ubuntu0.1=7.0.52-1ubuntu0.3=7.0.52-1ubuntu0.6=7.0.52-1ubuntu0.7=7.0.52-1ubuntu0.8=7.0.52-1ubuntu0.9=7.0.52-1ubuntu0.10=7.0.52-1ubuntu0.11=7.0.52-1ubuntu0.13=7.0.52-1ubuntu0.14=7.0.52-1ubuntu0.15=7.0.52-1ubuntu0.16=7.0.52-1ubuntu0.16+esm1=7.0.52-1ubuntu0.16+esm2
Ubuntu:Pro:16.04:LTSmore threats →ghsa
tomcat8
pkg:deb/ubuntu/[email protected]+esm2?arch=source&distro=esm-infra-legacy/xenial
Affected versions
=8.0.26-1=8.0.28-1=8.0.30-1=8.0.32-1=8.0.32-1ubuntu1=8.0.32-1ubuntu1.1=8.0.32-1ubuntu1.2=8.0.32-1ubuntu1.3=8.0.32-1ubuntu1.4=8.0.32-1ubuntu1.5=8.0.32-1ubuntu1.6=8.0.32-1ubuntu1.7=8.0.32-1ubuntu1.8=8.0.32-1ubuntu1.9=8.0.32-1ubuntu1.10=8.0.32-1ubuntu1.11=8.0.32-1ubuntu1.13=8.0.32-1ubuntu1.13+esm1=8.0.32-1ubuntu1.13+esm2
Ubuntu:Pro:16.04:LTSmore threats →ghsa
tomcat7
pkg:deb/ubuntu/[email protected]+esm4?arch=source&distro=esm-apps-legacy/xenial
Affected versions
=7.0.64-1=7.0.68-1=7.0.68-1ubuntu0.1=7.0.68-1ubuntu0.3=7.0.68-1ubuntu0.4=7.0.68-1ubuntu0.4+esm1=7.0.68-1ubuntu0.4+esm2=7.0.68-1ubuntu0.4+esm3=7.0.68-1ubuntu0.4+esm4
Ubuntu:Pro:18.04:LTSmore threats →ghsa
tomcat8
pkg:deb/ubuntu/[email protected]~18.04.3+esm6?arch=source&distro=esm-apps/bionic
Affected versions
=8.5.21-1ubuntu1=8.5.29-1=8.5.30-1=8.5.30-1ubuntu1=8.5.30-1ubuntu1.2=8.5.30-1ubuntu1.3=8.5.30-1ubuntu1.4=8.5.39-1ubuntu1~18.04.1=8.5.39-1ubuntu1~18.04.2=8.5.39-1ubuntu1~18.04.3=8.5.39-1ubuntu1~18.04.3+esm1=8.5.39-1ubuntu1~18.04.3+esm2=8.5.39-1ubuntu1~18.04.3+esm3=8.5.39-1ubuntu1~18.04.3+esm4=8.5.39-1ubuntu1~18.04.3+esm5=8.5.39-1ubuntu1~18.04.3+esm6
Ubuntu:Pro:18.04:LTSmore threats →ghsa
tomcat9
pkg:deb/ubuntu/[email protected]+esm8?arch=source&distro=esm-apps/bionic
Affected versions
=9.0.16-3~18.04.1=9.0.16-3ubuntu0.18.04.1=9.0.16-3ubuntu0.18.04.2=9.0.16-3ubuntu0.18.04.2+esm1=9.0.16-3ubuntu0.18.04.2+esm2=9.0.16-3ubuntu0.18.04.2+esm3=9.0.16-3ubuntu0.18.04.2+esm4=9.0.16-3ubuntu0.18.04.2+esm5=9.0.16-3ubuntu0.18.04.2+esm6=9.0.16-3ubuntu0.18.04.2+esm7=9.0.16-3ubuntu0.18.04.2+esm8
Ubuntu:Pro:20.04:LTSmore threats →ghsa
tomcat9
pkg:deb/ubuntu/[email protected]+esm3?arch=source&distro=esm-apps/focal
Affected versions
=9.0.24-1=9.0.27-1=9.0.31-1=9.0.31-1ubuntu0.1=9.0.31-1ubuntu0.2=9.0.31-1ubuntu0.3=9.0.31-1ubuntu0.4=9.0.31-1ubuntu0.5=9.0.31-1ubuntu0.6=9.0.31-1ubuntu0.7=9.0.31-1ubuntu0.8=9.0.31-1ubuntu0.9=9.0.31-1ubuntu0.9+esm1=9.0.31-1ubuntu0.9+esm2=9.0.31-1ubuntu0.9+esm3
Ubuntu:Pro:22.04:LTSmore threats →ghsa
tomcat9
pkg:deb/ubuntu/[email protected]+esm4?arch=source&distro=esm-apps/jammy
Affected versions
=9.0.43-3=9.0.54-1=9.0.55-1=9.0.58-1=9.0.58-1ubuntu0.1=9.0.58-1ubuntu0.1+esm1=9.0.58-1ubuntu0.1+esm2=9.0.58-1ubuntu0.1+esm3=9.0.58-1ubuntu0.1+esm4=9.0.58-1ubuntu0.2=9.0.58-1ubuntu0.2+esm1=9.0.58-1ubuntu0.2+esm2=9.0.58-1ubuntu0.2+esm3=9.0.58-1ubuntu0.2+esm4
Ubuntu:Pro:24.04:LTSmore threats →ghsa
tomcat10
pkg:deb/ubuntu/[email protected]~esm4?arch=source&distro=esm-apps/noble
Affected versions
=10.1.10-1=10.1.14-1=10.1.15-1=10.1.16-1=10.1.16-1ubuntu0.1~esm1=10.1.16-1ubuntu0.1~esm2=10.1.16-1ubuntu0.1~esm3=10.1.16-1ubuntu0.1~esm4
Ubuntu:Pro:24.04:LTSmore threats →ghsa
tomcat9
pkg:deb/ubuntu/[email protected]+esm3?arch=source&distro=esm-apps/noble
Affected versions
=9.0.70-1ubuntu1=9.0.70-2=9.0.70-2ubuntu0.1=9.0.70-2ubuntu0.1+esm1=9.0.70-2ubuntu0.1+esm2=9.0.70-2ubuntu0.1+esm3
Ubuntu:25.10more threats →ghsa
tomcat10
pkg:deb/ubuntu/[email protected]?arch=source&distro=questing
Affected versions
=10.1.35-1=10.1.40-1=10.1.40-1ubuntu1=10.1.40-1ubuntu1.25.10.1
Ubuntu:25.10more threats →ghsa
tomcat11
pkg:deb/ubuntu/[email protected]?arch=source&distro=questing
Affected versions
=11.0.6-1
Ubuntu:25.10more threats →ghsa
tomcat9
pkg:deb/ubuntu/[email protected]?arch=source&distro=questing
Affected versions
=9.0.70-2ubuntu1.1=9.0.70-2ubuntu2=9.0.70-2ubuntu3=9.0.95-1ubuntu1=9.0.95-1ubuntu1.1
Ubuntu:26.04:LTSmore threats →ghsa
tomcat10
pkg:deb/ubuntu/[email protected]~26.04.1?arch=source&distro=resolute
Affected versions
=10.1.40-1ubuntu1=10.1.40-1ubuntu1.26.04.1=10.1.55-1ubuntu2~26.04.1
Ubuntu:26.04:LTSmore threats →ghsa
tomcat9
pkg:deb/ubuntu/[email protected]~26.04.1?arch=source&distro=resolute
Affected versions
=9.0.95-1ubuntu1=9.0.111-1=9.0.115-1=9.0.115-1ubuntu0.1=9.0.118-1~26.04.1
Ubuntu:26.04:LTSmore threats →ghsa
tomcat11
pkg:deb/ubuntu/[email protected]~26.04.1?arch=source&distro=resolute
Affected versions
=11.0.6-1=11.0.11-1=11.0.15-1=11.0.18-1=11.0.18-1ubuntu0.1~esm1=11.0.22-2ubuntu2~26.04.1

Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.

AI-Powered Analysis

Machine-generated threat intelligence

AILast updated: 09/12/2026, 14:18:48 UTC

Technical Analysis

CVE-2026-55957 is an authentication bypass vulnerability in Apache Tomcat when the JNDIRealm is configured to authenticate binds using GSSAPI. Due to a missing critical step in the authentication process, attackers can bypass password verification and gain unauthorized access. This affects Tomcat versions from 7.0.0 through 7.0.109, 8.5.0 through 8.5.100, 9.0.0 through 9.0.100, 10.1.0 through 10.1.36, and 11.0.0 through 11.0.4. The issue is resolved in versions 11.0.5, 10.1.37, and 9.0.101.

Potential Impact

Successful exploitation allows attackers to authenticate without providing the correct password, potentially granting unauthorized access to systems relying on JNDIRealm with GSSAPI authentication. This could lead to unauthorized access to protected resources or administrative functions within affected Apache Tomcat servers.

Mitigation Recommendations

A patch is available. Users should upgrade Apache Tomcat to version 11.0.5, 10.1.37, or 9.0.101 or later to remediate this vulnerability. Applying these official fixes will prevent authentication bypass via the JNDIRealm GSSAPI mechanism.

Pro Console: star threats, build custom feeds, automate alerts via Slack, email & webhooks.Upgrade to Pro

Technical Details

Gcve Source
db.gcve.eu
Osv Id
UBUNTU-CVE-2026-55957
Osv Schema Version
1.7.0
Ecosystems
["Ubuntu:Pro:14.04:LTS","Ubuntu:Pro:16.04:LTS","Ubuntu:Pro:18.04:LTS","Ubuntu:Pro:20.04:LTS","Ubuntu:Pro:22.04:LTS","Ubuntu:Pro:24.04:LTS","Ubuntu:25.10","Ubuntu:26.04:LTS"]
Cvss Version
3.1
State
PUBLISHED

Threat ID: 6a58b47468715ace43d8d5ea

Added to database: 07/16/2026, 10:37:40 UTC

Last enriched: 09/12/2026, 14:18:48 UTC

Last updated: 09/14/2026, 22:01:35 UTC

Views: 28

Community Reviews

0 reviews

Crowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.

Sort by
Loading community insights…

Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.

Actions

PRO

Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.

Please log in to the Console to use AI analysis features.

Need more coverage?

Upgrade to Pro Console for AI refresh and higher limits.

For incident response and remediation, OffSeq services can help resolve threats faster.

Latest Threats

Breach by OffSeqOFFSEQFRIENDS — 25% OFF

Check if your credentials are on the dark web

Instant breach scanning across billions of leaked records. Free tier available.

Scan now
OffSeq TrainingCredly Certified

Lead Pen Test Professional

Technical5-day eLearningPECB Accredited
View courses