Loading vulnerability…
Authentication Bypass in Apache Tomcat JNDIRealm GSSAPI
CVE-2026-55957 is a missing critical authentication step in Apache Tomcat JNDIRealm when configured to authenticate binds using GSSAPI. The flaw allows an attacker to authenticate without supplying the correct password. Affected releases are 11.0.0-M1 through 11.0.4, 10.1.0-M1 through 10.1.36, 9.0.0.M1 through 9.0.100, 8.5.0 through 8.5.100, and 7.0.0 through 7.0.109.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation bypasses password authentication and may permit unauthorized access to applications and resources protected by the affected realm. The resulting access depends on the permissions associated with the authenticated identity. The vulnerability-specific CVSS v3.0 assessment assigns low confidentiality, integrity, and availability impacts.
If you can’t patch tonight, do this now.
Until updates can be installed, do not configure JNDIRealm to authenticate binds using GSSAPI. Use an alternative supported realm or bind-authentication configuration that does not rely on the affected GSSAPI bind path, and restrict access to application authentication endpoints to trusted networks where operationally feasible.
Patch, then assume compromise.
Upgrade Apache Tomcat to 11.0.5, 10.1.37, or 9.0.101, or a later fixed release in the corresponding branch. Migrate affected 7.0 and 8.5 deployments to a supported fixed release. For distribution-managed installations, apply the vendor's security update addressing CVE-2026-55957.
1 exploit validated by Mallory's analysis. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
44 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.