Loading vulnerability…
Fail-open authentication in Apache Tomcat DataSourceRealm
CVE-2026-68569 is an improper-authentication vulnerability in Apache Tomcat that allows principal lookup to fail open under certain authentication configurations, including CLIENT-CERT and SPNEGO. Tomcat may treat a user as authenticated even when that user does not exist in the configured DataSourceRealm. Affected versions are 11.0.0-M1 through 11.0.24, 10.1.0-M1 through 10.1.57, and 9.0.0.M1 through 9.0.120. End-of-life versions 8.5.0 through 8.5.100 and 7.0.0 through 7.0.109 are also affected; other unsupported releases may be affected.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation bypasses the intended requirement that an authenticated principal exist in DataSourceRealm. This may permit unauthorized access to protected applications and resources, potentially compromising confidentiality and integrity. Actual access depends on application authorization rules; the flaw does not establish unrestricted role assignment, arbitrary code execution, or an availability impact.
If you can’t patch tonight, do this now.
Until patched, restrict or disable affected CLIENT-CERT and SPNEGO authentication paths where operationally feasible. Limit access to affected applications through trusted networks and independently enforced reverse-proxy authentication and access controls. Review DataSourceRealm and authentication configurations, and monitor successful authentication events for nonexistent or unexpected principals. These measures reduce exposure but do not replace the fix.
Patch, then assume compromise.
Upgrade Apache Tomcat to 11.0.25 or later, 10.1.58 or later, or 9.0.121 or later within the applicable release branch. Migrate affected Tomcat 7 and 8.5 installations to a supported, fixed release. For vendor-packaged or embedded Tomcat, install the applicable vendor security update. Identified fixed downstream releases include Red Hat JBoss Web Server 6.2.5 and 7.0.2, Atlassian Confluence 9.2.26, 10.2.19, and 11.0.0, and Jira Service Management 10.3.25 and 11.3.11.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
31 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.