Loading vulnerability…
Apache Tomcat JNDIRealm Authentication Bypass
CVE-2026-101296 is a missing-critical-authentication-step vulnerability in Apache Tomcat's JNDIRealm. When the realm uses a non-GSSAPI SASL authentication mechanism, bind credential validation fails open, allowing authentication without the correct password. Affected versions are 11.0.0-M1 through 11.0.26, 10.1.0-M1 through 10.1.60, and 9.0.0.M1 through 9.0.122. End-of-life versions 8.5.0 through 8.5.100 and 7.0.0 through 7.0.109 are also affected; other unsupported versions may be affected. The vulnerability is configuration-dependent and does not bypass authentication across all Tomcat installations.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Attackers can bypass password verification and gain unauthorized authenticated access to applications using the affected JNDIRealm configuration. Access to protected data and application operations depends on the permissions associated with the authenticated identity. Direct code execution or service disruption is not established.
If you can’t patch tonight, do this now.
No temporary workaround is specified. Assess exposure by verifying whether JNDIRealm is configured with a non-GSSAPI SASL authentication mechanism; the authentication bypass is specific to that configuration.
Patch, then assume compromise.
Upgrade Apache Tomcat to 11.0.27 or later in the 11.0 branch, 10.1.61 or later in the 10.1 branch, or 9.0.123 or later in the 9.0 branch. Migrate affected end-of-life 8.5.x and 7.0.x deployments to a supported, fixed release; no fixes for those branches are identified.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.