Executive brief
Apache Tomcat is a widely used web server and application container for Java applications. A security flaw has been identified where the system may fail to properly reject invalid or unauthorized client certificates during the login process. This could allow an attacker to bypass security controls and gain unauthorized access to protected web applications and sensitive data.
Technical details
An improper authentication vulnerability (CWE-287) exists in Apache Tomcat and Apache Tomcat Native when using CLIENT_CERT authentication. The root cause is a failure in the authentication logic where the system does not fail as expected in certain scenarios, even when 'soft fail' is disabled. This allows a remote, unauthenticated attacker to bypass certificate-based security constraints over the network. The vulnerability affects Tomcat versions 9.x, 10.x, and 11.x, as well as multiple branches of Tomcat Native. Patches are available in Tomcat 9.0.116, 10.1.53, 11.0.20, and Tomcat Native 1.3.7 and 2.0.14.
Affected products
- Apache Tomcat 11.0.0-M1 through 11.0.18, 10.1.0-M7 through 10.1.52, 9.0.83 through 9.0.115
- Apache Tomcat Native 1.1.23 through 1.1.34, 1.2.0 through 1.2.39, 1.3.0 through 1.3.6, 2.0.0 through 2.0.13
Timeline
- 2026-04-09: disclosed
- 2026-04-09: advisory