Loading vulnerability…
CVE-2026-55957 is a missing-authentication-step vulnerability in Apache Tomcat JNDIRealm deployments configured to authenticate directory binds using GSSAPI. Under this configuration, authentication can succeed without the requester supplying the correct password. Affected releases are Tomcat 11.0.0-M1 through 11.0.4, 10.1.0-M1 through 10.1.36, 9.0.0.M1 through 9.0.100, 8.5.0 through 8.5.100, and 7.0.0 through 7.0.109.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository is a self-contained reproduction lab and PoC for CVE-2026-55957, an Apache Tomcat JNDIRealm authentication bypass when LDAP connections use GSSAPI and password validation occurs via bind-as-user. It is not a generic offensive exploit kit; it is a controlled research bundle that builds a Dockerized environment with four main components: a Kerberos KDC (`kerberos/`), a GSSAPI-capable 389 Directory Server (`ldap/`), a vulnerable Tomcat 10.1.36 instance (`tomcat-vulnerable/`), and a patched Tomcat 10.1.39 control (`tomcat-patched/`). A minimal protected webapp (`test-app/`) exposes `/probe/protected.jsp`, and the Python probe (`poc/auth_probe.py`) performs exactly one HTTP Basic-auth request to approved lab targets only, then reports whether protected content, principal creation, role authorization, session establishment, and cookie issuance occurred. The main orchestration entry point is `verify.sh`, which verifies bundled Tomcat archive hashes, builds the containers, starts the lab, runs the probe against vulnerable and patched targets, and asserts the expected matrix: correct password succeeds on both, wrong password succeeds only on 10.1.36, and nonexistent user fails. Supporting material under `evidence/`, `report/`, and `ghsa/` documents patch analysis, clean verification transcripts, upstream references, and advisory drafts. The exploit capability demonstrated is remote web authentication bypass against a specifically configured Tomcat deployment, resulting in unauthorized access as any known existing LDAP user without knowing that user’s password.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
25 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A vulnerability in Apache Tomcat that could allow an attacker to authenticate without the correct password and gain access to protected application resources.
An authentication bypass vulnerability in Apache Tomcat affecting the JNDIRealm component when configured with GSSAPI authenticated bind, caused by improper enforcement of default servlet security constraints and HTTP method restrictions.
An authentication-bypass vulnerability in Apache Tomcat's JNDIRealm when it is configured for GSSAPI-authenticated binds. An attacker can authenticate without supplying the correct password.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.