Executive brief
Undertow is a web server component used in Red Hat JBoss application servers to handle network communications. An attacker with direct access to the AJP (Apache JServ Protocol) port can forge SSL certificate attributes to bypass client certificate authentication, gaining unauthorized access to protected applications without valid credentials.
Technical details
The vulnerability exists in Undertow's AJP listener implementation, which accepts forged ssl_cert and is_ssl AJP protocol attributes without validating a shared-secret authentication mechanism. An unauthenticated attacker with direct TCP network access to the AJP port (default 8009) can craft malicious AJP messages containing fabricated X.509 certificate data to spoof CLIENT-CERT authentication. This allows the attacker to bypass certificate-based access controls and authenticate as arbitrary clients. The root cause is insufficient validation of AJP attribute origin and integrity. Patches are expected from Red Hat for affected JBoss product versions.
Affected products
- Red Hat Undertow
Timeline
- 2026-08-11: disclosed
- other: CVE-2026-15554 assigned