CVE-2026-55957

CVE-2026-55957: Apache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bind

Vendor Apache Software Foundation
Product Apache Tomcat
Weakness CWE-304
Published June 29, 2026
Last update June 30, 2026
View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.4, from 10.1.0-M1 through 10.1.36, from 9.0.0.M1 through 9.0.100, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Users are recommended to upgrade to version 11.0.5, 10.1.37 or 9.0.101, which fixes the issue.

Key dates

02Disclosure timeline

June 29, 2026 CVE published
June 30, 2026 Record updated