Loading vulnerability…
Declarative Role Constraint Bypass in Apache Tomcat
CVE-2026-66422 is an improper authorization vulnerability in Apache Tomcat. Servlet security-role-ref definitions are incorrectly treated as role aliases within the Realm, in addition to their intended use by Request.isUserInRole(). This can cause incorrect authorization decisions and allow bypass of declarative role constraints. Affected versions are 11.0.0-M1 through 11.0.24, 10.1.0-M1 through 10.1.57, and 9.0.25 through 9.0.120. End-of-life versions 8.5.46 through 8.5.100 and 7.0.97 through 7.0.109 are also affected; other unsupported versions may be affected.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An authenticated, low-privileged attacker may bypass declarative role restrictions and perform operations that should require a different security role. The resulting integrity and availability consequences depend on the protected application functionality exposed by the incorrect authorization decision. The vulnerability-specific CVSS v3.0 assessment is 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H), indicating high integrity and availability impacts and no confidentiality impact.
If you can’t patch tonight, do this now.
No vulnerability-specific alternative workaround is documented. Until fixed releases can be deployed, restrict network access to affected applications and enforce independent compensating access controls for protected functionality. Such controls reduce exposure but do not correct Tomcat's authorization behavior.
Patch, then assume compromise.
Upgrade Apache Tomcat to 11.0.25 or later, 10.1.58 or later, or 9.0.121 or later within the corresponding supported branch. Migrate affected Tomcat 7 and 8.5 deployments to a supported fixed branch. For products bundling Tomcat, apply the vendor-supported security update rather than independently replacing embedded components. Identified fixed product releases include Atlassian Confluence 9.2.26, 10.2.19, and 11.0.0; Red Hat JBoss Web Server 6.2.5 and 7.0.2; and VMware Spring Cloud Data Flow for Kubernetes 1.6.16.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
28 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.