Apache Tomcatで認証を回避される脆弱性
Summary
JNDI レルムで GSSAPI 以外の SASL 認証方式を使用している場合、攻撃者が正しいパスワードを提示せずに認証を通過できる脆弱性です。影響を受けるのは Apache Tomcat 11.0.26 以前、10.1.60 以前、9.0.122 以前などです。11.0.27、10.1.61、9.0.123 以降へ更新してください。
AI summary
Written by an external AI model and may contain mistakes. Check the original description and references below before acting on it.
JNDI レルムで GSSAPI 以外の SASL 認証方式を使用している場合、攻撃者が正しいパスワードを提示せずに認証を通過できる脆弱性です。影響を受けるのは Apache Tomcat 11.0.26 以前、10.1.60 以前、9.0.122 以前などです。11.0.27、10.1.61、9.0.123 以降へ更新してください。
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Tomcat |
11.0.0-M1 – 11.0.26 10.1.0-M1 – 10.1.60 9.0.0.M1 – 9.0.122 8.5.0 – 8.5.100 7.0.0 – 7.0.109 |
— — — — — |
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2026-101296 tomcat11
Original description The description as published by the source.
A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI SASL authentication mechanism allowed attackers to authenticate without providing the correct password.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.26, from 10.1.0-M1 through 10.1.60, from 9.0.0.M1 through 9.0.122.
The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.
Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.
Source: NIST National Vulnerability Database NVD GitHub Advisory
References
- REDHAT Red Hat
- web security@apache.org
- web nvd.nist.gov
- web github.com
- web openwall.com