Does your Apache Tomcat instance risk unauthenticated access due to CVE-2026-101296 JNDI realm flaw?

The short version

• Apache Tomcat contains a critical authentication bypass in its JNDI realm handling.
• Attackers can access resources without providing correct credentials under specific configurations.
• Vendors have released patched versions for supported branches, urging immediate upgrades.

The details

Apache Tomcat suffers from a missing critical step in authentication, rated as critical with a CVSS score of 9.1. According to the National Vulnerability Database, this weakness, classified as CWE-304, occurs when the JNDI realm is configured with a non-GSSAPI SASL authentication mechanism. In these scenarios, the system fails to validate bind credentials properly, allowing attackers to authenticate without supplying the correct password. This effectively bypasses the intended security controls for those specific realm configurations.

The context

The vulnerability affects a wide range of Apache Tomcat versions. Supported branches include versions 11.0.0-M1 through 11.0.26, 10.1.0-M1 through 10.1.60, and 9.0.0.M1 through 9.0.122. Additionally, several end-of-life versions are known to be affected, including 8.5.0 through 8.5.100 and 7.0.0 through 7.0.109. Other unsupported versions may also be vulnerable. Mark Thomas posted the advisory on the oss-security mailing list on 20 October, highlighting the severity for administrators relying on these configurations.

Next steps

Users are recommended to upgrade to version 11.0.27, 10.1.61, or 9.0.123, which fix the issue. Organisations running older, unsupported versions must assess their exposure and consider migration paths or compensating controls. Since no fix exists for the end-of-life branches, disabling the vulnerable JNDI realm configurations or switching to GSSAPI SASL mechanisms may reduce risk until a full migration is possible.

What defenders should look for

Security operations teams should monitor for successful authentication events that lack corresponding credential validation logs. Look for unusual access patterns from known external IPs to protected resources. Check for spikes in successful logins followed by rapid data exfiltration or privilege escalation attempts. Verify that no anonymous or empty-password sessions are being established in JNDI-configured realms. Investigate any alerts indicating bypassed authentication checks. Contain potential compromises by isolating affected servers and reviewing access logs for unauthorized activity.

What to do and how to stay safe: Apache Tomcat

• Audit all Apache Tomcat installations for JNDI realm configurations using non-GSSAPI SASL mechanisms.
• Upgrade affected servers to the latest patched versions provided by the Apache Software Foundation.
• Monitor authentication logs for successful logins without corresponding password validation entries.
• Restrict network access to Tomcat instances to trusted sources until patches are applied.

Step-by-step guide: How Virtual Patching Works: The Mechanics Behind Inline Protection

General security guidance from the Honeypot Daily newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which Apache Tomcat versions are affected by CVE-2026-101296?

Versions 11.0.0-M1 through 11.0.26, 10.1.0-M1 through 10.1.60, 9.0.0.M1 through 9.0.122, 8.5.0 through 8.5.100, and 7.0.0 through 7.0.109 are affected.

Is there a patch available for this vulnerability?

Yes, users can upgrade to version 11.0.27, 10.1.61, or 9.0.123 to fix the issue.

What is the severity of CVE-2026-101296?

The vulnerability is rated as critical with a CVSS score of 9.1.