As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-101296: Apache Tomcat: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms
Apache Tomcat versions 7 through 11 contain an authentication bypass vulnerability in the JNDI realm when configured with non-GSSAPI SASL mechanisms. The vulnerability stems from a missing validation step that allows attackers to authenticate without proper credential verification. The flaw affects multiple active and legacy versions of the application server.
Why it matters: Organizations running Tomcat with JNDI realm and non-GSSAPI SASL authentication face immediate authentication bypass risk and should verify their configurations and apply available patches.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-101296: Apache Tomcat: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms
Apache Tomcat versions 7.0.0 through 11.0.26 contain a vulnerability in the JNDI realm authentication mechanism where a missing validation step allows credential checks to fail open when using non-GSSAPI SASL mechanisms. An attacker could bypass authentication by exploiting this flaw in affected deployments.
Why it matters: Organizations running Tomcat with JNDI realm and non-GSSAPI SASL mechanisms are exposed to authentication bypass; patching or disabling the vulnerable configuration is required to prevent unauthorized access.
- Source published
- First seen by Cybersecurity Tracker