CVE-2026-66422 is an improper authorization vulnerability in Apache Tomcat caused by incorrect use of security-role-ref definitions as role aliases within the Realm, in addition to their correct use with Request.isUserInRole(). This affects multiple versions of Apache Tomcat, including 11.0.0-M1 through 11.0.24, 10.1.0-M1 through 10.1.57, 9.0.25 through 9.0.120, and some older EOL versions. The issue allows unauthorized actions due to flawed role authorization checks. Upgrading to versions 11.0.25, 10.1.58, or 9.0.121 resolves the vulnerability.
An off-by-one error vulnerability (CWE-193) in Apache Tomcat's rewrite valve processing causes the rewrite to restart at the second rule instead of the first. This affects multiple versions of Apache Tomcat from 8.5.0 through 11.0.24. The issue has been fixed in versions 11.0.25, 10.1.58, and 9.0.121. The vulnerability has a CVSS score of 7.5, indicating high severity, and impacts availability without affecting confidentiality or integrity.
CVE-2026-73180 is an Insufficient Session Expiration vulnerability in Apache Tomcat affecting multiple versions. The issue occurs when a session ID for an authenticated HTTP session changes after a WebSocket connection is established; the WebSocket session does not close as required when the HTTP session ends. This affects Apache Tomcat versions from 11.0.0-M1 through 11.0.24, 10.1.0-M1 through 10.1.57, and 9.0.0.M1 through 9.0.120, as well as some older EOL versions. Users are advised to upgrade to fixed versions 11.0.25, 10.1.58, or 9.0.121.
An uncontrolled resource consumption vulnerability exists in Apache Tomcat due to an allocation leak in HTTP/2 backlog tracking when a stream is reset. This affects multiple versions across the 8.5.x, 9.0.x, 10.1.x, and 11.0.x branches. The vulnerability can lead to denial of service by exhausting server resources. Fixed versions have been released to address this issue.
CVE-2026-65905 is a critical authentication bypass vulnerability in Apache Tomcat's DIGEST authenticator. It allows replaying a DIGEST authenticated request once if the nonceCount is at the upper boundary of the replay window before windowSize requests have been made. This affects multiple Apache Tomcat versions from 7.0.30 through 11.0.24 and some earlier unsupported versions. The issue is fixed in Apache Tomcat versions 11.0.25, 10.1.58, and 9.0.121.
CVE-2026-65637 is a critical improper input validation vulnerability in Apache Tomcat. It affects versions 11.0.20 through 11.0.24, 10.1.53 through 10.1.57, and 9.0.115 through 9.0.120. The issue arises from an incomplete fix for a previous vulnerability (CVE-2026-32990). Successful exploitation could lead to full confidentiality, integrity, and availability impact. Users are advised to upgrade to fixed versions 11.0.25, 10.1.58, or 9.0.121.
CVE-2026-65183 is a Time-of-check Time-of-use (TOCTOU) race condition vulnerability in Apache Tomcat affecting unix domain socket creation. It allows an unauthorized local user to access the unix domain socket. The vulnerability affects Apache Tomcat versions from 11.0.0-M1 through 11.0.24, 10.1.0-M1 through 10.1.57, and 9.0.42 through 9.0.120. Upgrading to versions 11.0.25, 10.1.58, or 9.0.121 mitigates the issue. The CVSS score is 8.1, indicating high severity.
SQL injection in Hive Metastore direct SQL partition-name resolution in Apache Hive before 4.2.1 on all platforms allows authenticated users with access to Hive Metastore APIs to read, modify, or affect unintended partition metadata (including statistics updates, truncation targets, and file-metadata cache operations) via crafted partition names in metastore RPC requests when direct SQL is enabled (the default). Users are recommended to upgrade to version 4.2.1, which fixes this issue.
Details about the issue:
Several Hive Metastore RPCs resolve partitions by full partition name (PART_NAME) through direct-SQL helpers. In those paths, client-supplied partition names are embedded into SQL using string concatenation (DirectSqlUpdatePart.quoteString() → '...') instead of bind parameters. A partition name containing a single quote (and crafted SQL) can alter the generated WHERE clause so that lookups intended for one partition match additional rows. That can affect reads, stats updates, truncate targets, metadata-cache targets, and related operations when metastore.try.direct.sql is enabled (default: true). An authenticated or network-trusted caller with the ability to invoke Hive Metastore partition-name APIs against a target table (directly or via Hive/other clients), when direct SQL is enabled can perform this attack. Also, the impact is mainly within table & partition targeting (read/update/truncate/drop/cache the wrong partitions in a table they can reference), not arbitrary cross-database access via this bug alone.
CVE-2026-55976 is a critical Server-Side Request Forgery (SSRF) vulnerability in Apache Hive before version 4.2.1. It allows an authenticated user with CREATE TABLE privileges to cause the Hive server to fetch attacker-controlled URLs during Avro schema resolution. This can lead to exposure of cloud instance metadata, internal network services, or local server files accessible by the Hive process identity. The vulnerability requires network access to HiveServer2 or Metastore and valid Hive authentication but does not require admin privileges. Users are advised to upgrade to Apache Hive 4.2.1, which addresses this issue.
An improper authentication vulnerability exists in Apache Hive versions 4.0.0 through 4.2.0 when using HiveServer2 with SAML authentication over HTTP transport. This flaw allows an unauthenticated attacker with network access to the HiveServer2 HTTP port to impersonate any Hive user by sending a forged Authorization: Bearer token to the /cliservice endpoint. No Hive credentials, SAML IdP login, or server signing secret knowledge is required. The vulnerability does not affect deployments where Apache Knox handles SSO and HiveServer2 uses LDAP or Kerberos authentication.
Apache DolphinScheduler before version 3.4.2 contains an authorization vulnerability (CWE-863) that allows a general user to mint admin access tokens via the /access-tokens endpoint. This flaw enables privilege escalation to administrative access. The issue is fixed in version 3.4.2.
Unauthenticated REST disclosure of certain content items in Apache Allura.
This issue affects Apache Allura: through 1.19.1.
Users are recommended to upgrade to version 1.20.0, which fixes the issue.
CVE-2026-78329 is a critical improper input validation vulnerability in the Apache Camel Undertow component. The issue arises because the default headerFilterStrategy used by UndertowEndpoint overwrites the intended UndertowHeaderFilterStrategy, causing undertow-specific header filtering to be bypassed. This allows legacy websocket. Exchange-header prefixed headers to be mapped onto the Exchange without proper filtering, potentially enabling an undertow WebSocket producer to dispatch messages incorrectly. The vulnerability affects Apache Camel versions from 4.11.0 before 4.14.9, from 4.15.0 before 4.18.4, and from 4.19.0 before 4.22.0. Upgrading to Apache Camel 4.22.0 or the respective LTS patch releases mitigates the issue. For deployments unable to upgrade immediately, explicit configuration of the headerFilterStrategy and manual header stripping are recommended as mitigations.
CVE-2026-71300 is an improper input validation vulnerability in the Apache Camel Atmosphere Websocket component. It allows an external sender to manipulate WebSocket message dispatch headers, potentially causing messages to be delivered to unintended connected clients. This issue affects multiple Apache Camel versions from 4.0.0 up to but not including 4.14.9, 4.15.0 up to but not including 4.18.4, and 4.19.0 up to but not including 4.22.0. The vulnerability is fixed in Apache Camel 4.22.0, 4.14.9, and 4.18.4. Users unable to upgrade immediately should strip the relevant dispatch headers at the trust boundary before the producer. The fix involves renaming header string values into the Camel namespace, which may cause breaking changes for routes that set them by literal string.
CVE-2026-63621 is an improper input validation vulnerability in the Apache Camel Knative component. It allows unauthenticated attackers to inject internal Camel headers via structured-mode CloudEvent requests, potentially enabling server-side request forgery, path traversal, or message dispatch redirection. This issue affects multiple Apache Camel versions and is fixed in later releases.
CVE-2026-66908 is an improper authentication vulnerability in the Apache Camel Platform HTTP Main component affecting versions from 4.8.0 up to but not including 4.22.0. The issue arises because the JWT authentication configuration does not enforce validation of the issuer (iss) and audience (aud) claims unless explicitly configured, allowing acceptance of any unexpired token signed by a trusted key. This can lead to acceptance of tokens intended for other services or audiences within the same trust domain. The vulnerability is fixed in version 4.22.0, which requires explicit configuration of issuer and audience claims or an explicit override to allow missing claims. Users on maintenance branches 4.14.x and 4.18.x should upgrade to versions 4.14.9 or 4.18.4 and configure these claims accordingly.
CVE-2026-66907 is a relative path traversal vulnerability in the Apache Camel Google Storage component. It affects versions from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, and from 4.19.0 before 4.22.0. The vulnerability arises because the component downloads Google Cloud Storage objects to the local filesystem without properly normalizing or restricting the destination path, allowing crafted object names containing parent-directory segments to escape the intended download directory. This can lead to arbitrary file creation or overwriting with the privileges of the Camel process. A fix is available in Apache Camel versions 4.14.9, 4.18.4, and 4.22.0.
CVE-2026-66906 is a critical relative path traversal vulnerability in the Apache Camel Azure Storage Blob component. It allows an attacker who can influence blob names in an Azure Storage container to cause Camel to write files outside the intended directory on the local filesystem. This occurs because the component does not normalize or restrict blob names containing parent-directory segments when downloading blobs to files. The vulnerability affects Apache Camel versions from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, and from 4.19.0 before 4.22.0. Fixed versions are available, and users are advised to upgrade to these fixed releases. Alternative mitigations include filtering blob names with regex or avoiding the vulnerable operation on untrusted containers.