CVE-2026-34487: Apache Tomcat sensitive information disclosure in clustering component

CVE-2026-34487 · Severity: high · CVSS 7.5 · Published 2026-04-09

Apache Tomcat is a widely used web server and application container. A vulnerability in its clustering component could cause sensitive Kubernetes security tokens to be written into system log files. If an unauthorized person gains access to these logs, they could use the tokens to compromise the underlying cloud infrastructure.

Technologies: Apache Tomcat, org.apache.tomcat:tomcat (Maven), org.apache.tomcat:tomcat-tribes (Maven), org.apache.tomcat.embed:tomcat-embed-core (Maven). Vendors: Apache, Maven.

Quick answers

Is CVE-2026-34487 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-34487 being exploited in the wild.
How severe is CVE-2026-34487?
High severity, with a CVSS score of 7.5, published 9 April 2026.
Which products and versions are affected?
Apache Tomcat 9.0.13 to 9.0.116, 10.1.0-M1 to 10.1.53, 11.0.0-M1 to 11.0.20; org.apache.tomcat:tomcat (Maven) ECOSYSTEM:introduced=9.0.13,fixed=9.0.117; org.apache.tomcat:tomcat-tribes (Maven) ECOSYSTEM:introduced=9.0.13,fixed=9.0.117; org.apache.tomcat.embed:tomcat-embed-core (Maven) ECOSYSTEM:introduced=9.0.13,fixed=9.0.117.
Is there a fix for CVE-2026-34487?
Yes. org.apache.tomcat:tomcat (Maven): upgrade to 9.0.117 or later; org.apache.tomcat:tomcat-tribes (Maven): upgrade to 9.0.117 or later; org.apache.tomcat.embed:tomcat-embed-core (Maven): upgrade to 9.0.117 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34487 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-34487?
Check whether you run Apache Tomcat, org.apache.tomcat:tomcat (Maven), org.apache.tomcat:tomcat-tribes (Maven) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.apache.tomcat:tomcat (Maven): upgrade to 9.0.117 or later
    # set org.apache.tomcat:tomcat to 9.0.117 in your pom.xml or build.gradle
  • org.apache.tomcat:tomcat-tribes (Maven): upgrade to 9.0.117 or later
    # set org.apache.tomcat:tomcat-tribes to 9.0.117 in your pom.xml or build.gradle
  • org.apache.tomcat.embed:tomcat-embed-core (Maven): upgrade to 9.0.117 or later
    # set org.apache.tomcat.embed:tomcat-embed-core to 9.0.117 in your pom.xml or build.gradle

Technical details

A CWE-532 (Insertion of Sensitive Information into Log File) vulnerability exists in the Apache Tomcat 'cloud membership for clustering' component. The root cause is the improper handling of Kubernetes bearer tokens, which are inadvertently written to log files during clustering operations. An attacker with access to the log files could retrieve these tokens to gain unauthorized access to the Kubernetes API. The issue affects Tomcat versions 9.x, 10.x, and 11.x; users should upgrade to 9.0.117, 10.1.54, or 11.0.21 respectively.

Affected products

  • Apache Tomcat 9.0.13 to 9.0.116, 10.1.0-M1 to 10.1.53, 11.0.0-M1 to 11.0.20
  • Apache Tomcat Tribes 9.0.13 to 9.0.116, 10.1.0-M1 to 10.1.53, 11.0.0-M1 to 11.0.20

Identifiers

  • CVE-2026-34487
  • GHSA-x4m4-345f-5h5g

Timeline

  • 2026-04-09: disclosed
  • 2026-04-09: advisory
  • 2026-04-09: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.