Loading vulnerability…
CVE-2026-29146 is an information disclosure vulnerability in Apache Tomcat's optional EncryptInterceptor component when used with its default configuration. The issue arises because EncryptInterceptor used AES/CBC/PKCS5Padding by default, making encrypted cluster traffic susceptible to a padding oracle attack. An attacker able to observe and interact with encrypted messages exchanged between Tomcat cluster nodes can use oracle responses derived from padding validation behavior to progressively decrypt protected message contents. Affected versions include Apache Tomcat 11.0.0-M1 through 11.0.18, 10.0.0-M1 through 10.1.52, 9.0.13 through 9.0.115, 8.5.38 through 8.5.100, and 7.0.100 through 7.0.109.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
Repository contains a small standalone proof-of-concept for CVE-2026-34486, plus a README explaining the regression in Apache Tomcat's EncryptInterceptor. The codebase is minimal: one Python script (exploit.py) and one documentation file. The exploit is not framework-based. The Python PoC constructs a Tomcat cluster message using a simple 4-byte big-endian length prefix followed by serialized payload bytes. By default it uses a minimal Java serialization stream containing a dummy object descriptor ('ExampleMessage'), but it also supports loading arbitrary serialized bytes from a local file via the --payload argument. It then opens a TCP connection to a user-specified host and port and sends the frame directly to the Tomcat cluster receiver. Its main capability is demonstrating a network-based plaintext message injection/bypass against vulnerable Tomcat cluster nodes configured with EncryptInterceptor. It does not include post-exploitation logic, authentication bypass chaining, remote code execution primitives, or a reverse shell. It is therefore best classified as a PoC that validates the vulnerable receive path by delivering unencrypted cluster traffic that should have been rejected. Operationally, the exploit requires a reachable Tomcat cluster receiver and a vulnerable version/configuration: Apache Tomcat 11.0.20, 10.1.53, or 9.0.116 with clustering enabled and EncryptInterceptor in use. The README notes common receiver ports 4000 or 5000, though the script itself accepts any user-supplied port. The provided result is successful delivery of a crafted unencrypted cluster frame that may be accepted and forwarded by the vulnerable interceptor chain despite decryption failure.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
30 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A critical Apache Tomcat vulnerability involving missing encryption of sensitive data; mentioned as the original flaw for which CVE-2026-34486 was an incomplete fix.
A padding oracle issue in Apache Tomcat EncryptInterceptor whose patch introduced CVE-2026-34486.
An information disclosure vulnerability affecting Confluence Data Center.
A padding oracle vulnerability in Apache Tomcat's EncryptInterceptor caused by default use of CBC mode, potentially allowing decryption of intercepted traffic.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.