Loading story…
Apache disclosed CVE-2026-56091, an authentication bypass vulnerability in the Apache Shiro shiro-guice module when deployed in a web servlet context. The flaw allows a specially crafted HTTP request to bypass authentication checks, creating a risk that unauthenticated users could reach protected application functionality. Apache described the issue as similar to CVE-2020-1957, but affecting shiro-guice rather than shiro-spring.
The vulnerability affects all Apache Shiro 2.x releases and 3.0.0-alpha-0 through 3.0.0-alpha-1 for the org.apache.shiro:shiro-guice component under the specified deployment conditions. Apache said the issue is remediated in Apache Shiro 3.0.0 and later and advised users to upgrade. The vulnerability was credited to LocalHost for discovery, with Lenny Primak credited for developing the fix.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
In the disclosure, Apache stated that upgrading to Apache Shiro 3.0.0 or later remediates CVE-2026-56091. The issue was credited to LocalHost for discovery and Lenny Primak for remediation development.
Apache disclosed CVE-2026-56091, an authentication bypass vulnerability in the Apache Shiro shiro-guice module when used in a web servlet context. The flaw can be triggered by a specially crafted HTTP request and affects all 2.x releases as well as 3.0.0-alpha-0 through 3.0.0-alpha-1.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcelists.apache.org
Open sourceseclists.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apache disclosed **CVE-2026-49268**, a high-severity LDAP Distinguished Name injection flaw in Apache Shiro’s `DefaultLdapRealm` that can let remote attackers manipulate LDAP bind authentication. The vulnerability is caused by directly concatenating user-supplied usernames into an LDAP DN template without escaping RFC 2253 special characters, allowing an attacker to alter DN construction and potentially bypass authentication or impersonate legitimate users. The issue carries a **CVSS v4 score of 8.8** and is considered remotely exploitable. The flaw affects Apache Shiro `shiro-core` through **2.2.0** and **3.0.0-alpha-0** through **3.0.0-alpha-1** when `DefaultLdapRealm` is in use. Apache said organizations should identify deployments using that realm and upgrade to **2.2.1** or **3.0.0-alpha-2** or later; input escaping for usernames is also recommended. The advisory credited **zhaokaifei of ChinaTelecom** with reporting the issue and **Lenny Primak** with developing the fix.
Jun 29, 2026
Apache released security updates for its Syncope identity and access management platform to fix multiple vulnerabilities across the 3.0, 4.0, and 4.1 branches, including remote code execution, SQL injection, privilege escalation, SSRF, information disclosure, XXE, XSS, and cryptographic weaknesses. The most severe issues include several Groovy-related post-authentication RCE flaws, while `CVE-2026-57308` affects Audit Events search through an unsanitized sort parameter that can enable authenticated SQL injection, and `CVE-2026-62183` can let a regular user elevate privileges through certain self-service workflow configurations and obtain administrator-level entitlements. Affected releases include Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, and 4.1.0-M0 through 4.1.1 for the newly disclosed SQL injection and privilege escalation bugs, with Apache delivering fixes in versions **4.0.7** and **4.1.2** and noting that some older flaws were addressed in earlier point releases such as **4.1.1**, **4.0.6**, **4.0.4**, **4.0.3**, **3.0.16**, and **3.0.15**. Apache said binary hotfixes are not available, requiring organizations to upgrade or rebuild from patched source, and urged administrators to review roles, entitlements, and self-service workflows; no public exploitation has been confirmed.
Jul 24, 2026
Apache disclosed **CVE-2026-59083**, a vulnerability in Tomcat's `RewriteValve` caused by incorrect URL decoding of hex-encoded characters that can let attackers bypass security controls in some configurations. The issue is classified as **CWE-177** and was described as low severity by Apache, though the CVE record notes network attackability with low attack complexity, no privileges required, and no user interaction. Apache said the flaw affects supported Tomcat branches **11.0.0-M1 through 11.0.23**, **10.1.0-M1 through 10.1.56**, and **9.0.0.M1 through 9.0.119**, with reports also listing **8.5.0 through 8.5.100** as affected. Apache and downstream advisories urged users to upgrade to fixed releases **11.0.24**, **10.1.57**, or **9.0.120**, while warning that older unsupported versions may also be vulnerable; versions before **8.0.0** were noted as unaffected in the oss-security disclosure. The vulnerability was published through Apache security pages, the Apache mailing list, and `oss-security`, with the CVE entry updated to include affected-version details, a CVSS v3.1 vector, and a CISA SSVC assessment.
Aug 28, 2026