Loading vulnerability…
Incomplete Authorization Configuration Logging in Apache Tomcat
CVE-2026-55276 is an always-incorrect control-flow implementation vulnerability in Apache Tomcat's Catalina component. When the effective web application deployment descriptor is logged, special roles and empty authorization constraints are omitted, producing an incomplete representation of security-relevant configuration. Affected versions are 11.0.0-M1 through 11.0.22, 10.1.0-M1 through 10.1.55, 9.0.0-M1 through 9.0.118, and 8.5.0 through 8.5.100. Other end-of-support versions may also be affected. The defect affects configuration visibility; it does not establish a bypass of runtime authorization enforcement.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Incomplete or misleading authorization-configuration logs can prevent administrators and security personnel from accurately reviewing special roles and empty authorization constraints during audits, troubleshooting, and incident investigations. Direct code execution, privilege escalation, data disclosure, or authorization bypass is not established for this vulnerability.
If you can’t patch tonight, do this now.
Until upgraded, do not rely solely on logged effective deployment descriptors to validate authorization configuration. Review deployed descriptors and authorization constraints directly. Restrict administrative access and monitor for unexpected authorization-configuration changes.
Patch, then assume compromise.
Upgrade Apache Tomcat to 11.0.23, 10.1.56, or 9.0.119, or a later fixed release in the corresponding branch. Migrate affected end-of-support installations, including Tomcat 8.5, to a supported fixed release. For affected ExtremeAnalytics for Site Engine and ExtremeControl for Site Engine deployments, upgrade to version 26.8.10 or later.
No validated public exploits yet. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
30 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.