CVE-2026-55957

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-55957
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55957.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-55957
Aliases
Downstream
Published
2026-06-29T20:47:12.661Z
Modified
2026-07-08T08:13:46.153908216Z
Severity
  • 7.3 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
Summary
Apache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bind
Details

Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.4, from 10.1.0-M1 through 10.1.36, from 9.0.0.M1 through 9.0.100, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.

Users are recommended to upgrade to version 11.0.5, 10.1.37 or 9.0.101, which fixes the issue.

Database specific 
{
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "11.0.0-M1"
                },
                {
                    "last_affected": "11.0.4"
                },
                {
                    "introduced": "10.1.0-M1"
                },
                {
                    "last_affected": "10.1.36"
                },
                {
                    "introduced": "9.0.0.M1"
                },
                {
                    "last_affected": "9.0.100"
                },
                {
                    "introduced": "8.5.0"
                },
                {
                    "last_affected": "8.5.100"
                },
                {
                    "introduced": "7.0.0"
                },
                {
                    "last_affected": "7.0.109"
                }
            ]
        },
        {
            "source": "DESCRIPTION",
            "extracted_events": [
                {
                    "introduced": "11.0.0-M1"
                },
                {
                    "fixed": "11.0.4"
                },
                {
                    "introduced": "10.1.0-M1"
                },
                {
                    "fixed": "10.1.36"
                },
                {
                    "introduced": "9.0.0.M1"
                },
                {
                    "fixed": "9.0.100"
                },
                {
                    "introduced": "8.5.0"
                },
                {
                    "fixed": "8.5.100"
                },
                {
                    "introduced": "7.0.0"
                },
                {
                    "fixed": "7.0.109"
                }
            ]
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55957.json",
    "cna_assigner": "apache",
    "cwe_ids": [
        "CWE-304"
    ]
}
References

Affected packages

Git / github.com/apache/tomcat

Affected ranges

Type
GIT
Repo
https://github.com/apache/tomcat
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
cf9caee37dd3d2dbb0294983e921c12a318c1f5e
Introduced
e9d17cddc285615807ec5fef09240777436b25dc
Fixed
e4338ee7a3e0f22d85f7cb2e04dacee752eaa619
Introduced
56e547d387ab49f688c93fe9ca082b1b5d94deed
Fixed
1ba1f9061e49ce03c77b57beff3d50e5c2c3ee29
Database specific 
{
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "9.0.101"
        },
        {
            "introduced": "10.1.0"
        },
        {
            "fixed": "10.1.37"
        },
        {
            "introduced": "11.0.0"
        },
        {
            "fixed": "11.0.5"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55957.json"