CVE-2026-101296

CVE-2026-101296 · Apache Tomcat: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI SASL authentication mechanism allowed attackers to authenticate without providing the correct password. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.26, from 10.1.0-M1 through 10.1.60, from 9.0.0.M1 through 9.0.122. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.

CVSS 9.1 · Critical · EPSS 0.7% · Fix available

Published: 2026-10-20T13:45:39.959Z
Updated: 2026-10-21T06:31:55.233Z

Stack: system

Affected products and versions

apache tomcat
Versions
- ≥ 11.0.0-M1, ≤ 11.0.26: Affected (semver)
- ≥ 10.1.0-M1, ≤ 10.1.60: Affected (semver)
- ≥ 9.0.0.M1, ≤ 9.0.122: Affected (semver)
- ≥ 8.5.0, ≤ 8.5.100: Affected (semver)
- ≥ 7.0.0, ≤ 7.0.109: Affected (semver)
No fix published
tomcat10 Debian:12
Versions
- 10.1.10-1
- 10.1.13-1
- 10.1.14-1
- 10.1.15-1
- 10.1.16-1
- 10.1.20-1
- 10.1.23-1
- 10.1.25-1
- 10.1.25-1~bpo12+1
- 10.1.25-2
- 10.1.30-1
- 10.1.30-1~bpo12+1
- 10.1.31-1
- 10.1.33-1
- 10.1.33-1~bpo12+1
- 10.1.34-0+deb12u1
- 10.1.34-0+deb12u2
- 10.1.34-1
- 10.1.35-1
- 10.1.40-1
- 10.1.40-1~bpo12+1
- 10.1.46-1
- 10.1.52-1
- 10.1.52-1~deb12u1
- 10.1.52-1~deb13u1
- 10.1.52-2
- 10.1.54-1
- 10.1.55-1
- 10.1.55-1~deb12u1
- 10.1.55-1~deb13u1
- 10.1.6-1
- 10.1.6-1+deb12u1
- 10.1.6-1+deb12u2
- 10.1.60-1
- 10.1.7-1
- 10.1.8-1
- 10.1.9-1
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat10 Debian:13
Versions
- 10.1.40-1
- 10.1.46-1
- 10.1.52-1
- 10.1.52-1~deb12u1
- 10.1.52-1~deb13u1
- 10.1.52-2
- 10.1.54-1
- 10.1.55-1
- 10.1.55-1~deb12u1
- 10.1.55-1~deb13u1
- 10.1.60-1
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat10 Debian:14
Versions
- 10.1.40-1
- 10.1.46-1
- 10.1.52-1
- 10.1.52-1~deb12u1
- 10.1.52-1~deb13u1
- 10.1.52-2
- 10.1.54-1
- 10.1.55-1
- 10.1.55-1~deb12u1
- 10.1.55-1~deb13u1
- 10.1.60-1
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat11 Debian:13
Versions
- 11.0.11-1
- 11.0.15-1
- 11.0.15-1~deb13u1
- 11.0.18-1
- 11.0.21-1
- 11.0.22-1
- 11.0.22-1~deb13u1
- 11.0.22-2
- 11.0.24-1
- 11.0.6-1
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat11 Debian:14
Versions
- 11.0.11-1
- 11.0.15-1
- 11.0.15-1~deb13u1
- 11.0.18-1
- 11.0.21-1
- 11.0.22-1
- 11.0.22-1~deb13u1
- 11.0.22-2
- 11.0.24-1
- 11.0.6-1
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat9 Debian:12
Affected ranges
- ECOSYSTEM: < 9.0.70-2
Update to 9.0.70-2
tomcat9 Debian:13
Affected ranges
- ECOSYSTEM: < 9.0.70-2
Update to 9.0.70-2
tomcat9 Debian:14
Affected ranges
- ECOSYSTEM: < 9.0.70-2
Update to 9.0.70-2
tomcat6 Ubuntu:Pro:14.04:LTS
Versions
- 6.0.37-1
- 6.0.39-1
- 6.0.39-1ubuntu0.1
- 6.0.39-1ubuntu0.1+esm1
- 6.0.39-1ubuntu0.1+esm2
- 6.0.39-1ubuntu0.1+esm3
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat7 Ubuntu:Pro:14.04:LTS
Versions
- 7.0.42-1
- 7.0.47-1
- 7.0.50-1
- 7.0.52-1
- 7.0.52-1ubuntu0.1
- 7.0.52-1ubuntu0.3
- 7.0.52-1ubuntu0.6
- 7.0.52-1ubuntu0.7
- 7.0.52-1ubuntu0.8
- 7.0.52-1ubuntu0.9
- 7.0.52-1ubuntu0.10
- 7.0.52-1ubuntu0.11
- 7.0.52-1ubuntu0.13
- 7.0.52-1ubuntu0.14
- 7.0.52-1ubuntu0.15
- 7.0.52-1ubuntu0.16
- 7.0.52-1ubuntu0.16+esm1
- 7.0.52-1ubuntu0.16+esm2
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat8 Ubuntu:Pro:16.04:LTS
Versions
- 8.0.26-1
- 8.0.28-1
- 8.0.30-1
- 8.0.32-1
- 8.0.32-1ubuntu1
- 8.0.32-1ubuntu1.1
- 8.0.32-1ubuntu1.2
- 8.0.32-1ubuntu1.3
- 8.0.32-1ubuntu1.4
- 8.0.32-1ubuntu1.5
- 8.0.32-1ubuntu1.6
- 8.0.32-1ubuntu1.7
- 8.0.32-1ubuntu1.8
- 8.0.32-1ubuntu1.9
- 8.0.32-1ubuntu1.10
- 8.0.32-1ubuntu1.11
- 8.0.32-1ubuntu1.13
- 8.0.32-1ubuntu1.13+esm1
- 8.0.32-1ubuntu1.13+esm2
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat7 Ubuntu:Pro:16.04:LTS
Versions
- 7.0.64-1
- 7.0.68-1
- 7.0.68-1ubuntu0.1
- 7.0.68-1ubuntu0.3
- 7.0.68-1ubuntu0.4
- 7.0.68-1ubuntu0.4+esm1
- 7.0.68-1ubuntu0.4+esm2
- 7.0.68-1ubuntu0.4+esm3
- 7.0.68-1ubuntu0.4+esm4
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat8 Ubuntu:Pro:18.04:LTS
Versions
- 8.5.21-1ubuntu1
- 8.5.29-1
- 8.5.30-1
- 8.5.30-1ubuntu1
- 8.5.30-1ubuntu1.2
- 8.5.30-1ubuntu1.3
- 8.5.30-1ubuntu1.4
- 8.5.39-1ubuntu1~18.04.1
- 8.5.39-1ubuntu1~18.04.2
- 8.5.39-1ubuntu1~18.04.3
- 8.5.39-1ubuntu1~18.04.3+esm1
- 8.5.39-1ubuntu1~18.04.3+esm2
- 8.5.39-1ubuntu1~18.04.3+esm3
- 8.5.39-1ubuntu1~18.04.3+esm4
- 8.5.39-1ubuntu1~18.04.3+esm5
- 8.5.39-1ubuntu1~18.04.3+esm6
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat9 Ubuntu:Pro:18.04:LTS
Versions
- 9.0.16-3~18.04.1
- 9.0.16-3ubuntu0.18.04.1
- 9.0.16-3ubuntu0.18.04.2
- 9.0.16-3ubuntu0.18.04.2+esm1
- 9.0.16-3ubuntu0.18.04.2+esm2
- 9.0.16-3ubuntu0.18.04.2+esm3
- 9.0.16-3ubuntu0.18.04.2+esm4
- 9.0.16-3ubuntu0.18.04.2+esm5
- 9.0.16-3ubuntu0.18.04.2+esm6
- 9.0.16-3ubuntu0.18.04.2+esm7
- 9.0.16-3ubuntu0.18.04.2+esm8
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat9 Ubuntu:Pro:20.04:LTS
Versions
- 9.0.24-1
- 9.0.27-1
- 9.0.31-1
- 9.0.31-1ubuntu0.1
- 9.0.31-1ubuntu0.2
- 9.0.31-1ubuntu0.3
- 9.0.31-1ubuntu0.4
- 9.0.31-1ubuntu0.5
- 9.0.31-1ubuntu0.6
- 9.0.31-1ubuntu0.7
- 9.0.31-1ubuntu0.8
- 9.0.31-1ubuntu0.9
- 9.0.31-1ubuntu0.9+esm1
- 9.0.31-1ubuntu0.9+esm2
- 9.0.31-1ubuntu0.9+esm3
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat9 Ubuntu:Pro:22.04:LTS
Versions
- 9.0.43-3
- 9.0.54-1
- 9.0.55-1
- 9.0.58-1
- 9.0.58-1ubuntu0.1
- 9.0.58-1ubuntu0.1+esm1
- 9.0.58-1ubuntu0.1+esm2
- 9.0.58-1ubuntu0.1+esm3
- 9.0.58-1ubuntu0.1+esm4
- 9.0.58-1ubuntu0.2
- 9.0.58-1ubuntu0.2+esm1
- 9.0.58-1ubuntu0.2+esm2
- 9.0.58-1ubuntu0.2+esm3
- 9.0.58-1ubuntu0.2+esm4
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat10 Ubuntu:24.04:LTS
Versions
- 10.1.10-1
- 10.1.14-1
- 10.1.15-1
- 10.1.16-1
- 10.1.16-1ubuntu0.1~esm1
- 10.1.16-1ubuntu0.1~esm2
- 10.1.16-1ubuntu0.1~esm3
- 10.1.16-1ubuntu0.1~esm4
- 10.1.55-1ubuntu2~24.04.1
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat9 Ubuntu:24.04:LTS
Versions
- 9.0.70-1ubuntu1
- 9.0.70-2
- 9.0.70-2ubuntu0.1
- 9.0.70-2ubuntu0.1+esm1
- 9.0.70-2ubuntu0.1+esm2
- 9.0.70-2ubuntu0.1+esm3
- 9.0.118-1~24.04.1
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat10 Ubuntu:26.10
Versions
- 10.1.40-1ubuntu1
- 10.1.54-1
- 10.1.54-1ubuntu1
- 10.1.54-1ubuntu2
- 10.1.55-1ubuntu1
- 10.1.55-1ubuntu2
- 10.1.57~us1-0ubuntu1
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat11 Ubuntu:26.10
Versions
- 11.0.18-1
- 11.0.22-2
- 11.0.22-2ubuntu1
- 11.0.22-2ubuntu2
- 11.0.24-1ubuntu1
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat9 Ubuntu:26.10
Versions
- 9.0.115-1
- 9.0.115-1ubuntu1
- 9.0.118-1
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat10 Ubuntu:26.04:LTS
Versions
- 10.1.40-1ubuntu1
- 10.1.40-1ubuntu1.26.04.1
- 10.1.55-1ubuntu2~26.04.1
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat9 Ubuntu:26.04:LTS
Versions
- 9.0.95-1ubuntu1
- 9.0.111-1
- 9.0.115-1
- 9.0.115-1ubuntu0.1
- 9.0.118-1~26.04.1
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat11 Ubuntu:26.04:LTS
Versions
- 11.0.6-1
- 11.0.11-1
- 11.0.15-1
- 11.0.18-1
- 11.0.18-1ubuntu0.1~esm1
- 11.0.22-2ubuntu2~26.04.1
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published

Original sources

Check your server →

CVE-2026-101296 · Apache Tomcat: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms

Affected products and versions

apache tomcat

tomcat10 Debian:12

tomcat10 Debian:13

tomcat10 Debian:14

tomcat11 Debian:13

tomcat11 Debian:14

tomcat9 Debian:12

tomcat9 Debian:13

tomcat9 Debian:14

tomcat6 Ubuntu:Pro:14.04:LTS

tomcat7 Ubuntu:Pro:14.04:LTS

tomcat8 Ubuntu:Pro:16.04:LTS

tomcat7 Ubuntu:Pro:16.04:LTS

tomcat8 Ubuntu:Pro:18.04:LTS

tomcat9 Ubuntu:Pro:18.04:LTS

tomcat9 Ubuntu:Pro:20.04:LTS

tomcat9 Ubuntu:Pro:22.04:LTS

tomcat10 Ubuntu:24.04:LTS

tomcat9 Ubuntu:24.04:LTS

tomcat10 Ubuntu:26.10

tomcat11 Ubuntu:26.10

tomcat9 Ubuntu:26.10

tomcat10 Ubuntu:26.04:LTS

tomcat9 Ubuntu:26.04:LTS

tomcat11 Ubuntu:26.04:LTS

Original sources