Executive brief
Apache Tomcat is a widely used web server and application container. A vulnerability in its WebSocket client could cause sensitive login credentials (authentication headers) to be sent to the wrong server if a connection is redirected. This could allow an attacker to intercept credentials and gain unauthorized access to protected systems or data.
Technical details
A vulnerability exists in the Apache Tomcat WebSocket client where it fails to properly clear or validate the destination of authentication headers during a redirect. If a WebSocket connection request is redirected after the initial authentication step, the client presents the most recent 'Authorization' header to the new target host. This is a classic information exposure issue (CWE-200) where sensitive credentials intended for one host are leaked to another. The vulnerability can be exploited by a network-based attacker who can trigger or influence a redirect to a malicious host. Patches have been released for all major supported branches (9.0.118, 10.1.55, 11.0.22).
Affected products
- Apache Tomcat 11.0.0-M1 to 11.0.21, 10.1.0-M1 to 10.1.54, 9.0.2 to 9.0.117, 8.5.24 to 8.5.100, 7.0.83 to 7.0.109
Timeline
- 2026-05-12: disclosed
- 2026-05-12: advisory
References
- https://lists.apache.org/thread/n61zwf75jrv09rz90j4jssncm244bwdb
- http://www.openwall.com/lists/oss-security/2026/05/12/14
- https://github.com/apache/tomcat/commit/169d725788ea6aec217ecac70fe4161c837ba423
- https://github.com/apache/tomcat/commit/6cbe274592ef2d11607b5b188e1df649de52f8d5
- https://github.com/apache/tomcat/commit/b7b173694d588ddcfa432f079baf763cbbbaa5c4