Skip to content
VulniPulse
Sign in
Highest advisory severityCritical 2 vendors · 2 advisories

CVE-2026-101296

missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI SASL authentication mechanism allowed attackers to authenticate without providing the correct password

CVE-2026-101296: missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI SASL…

Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.

NVD detail CVE.org

CVE-2026-101296 at a glance

CISA KEV
Not listed (catalog checked )
Highest advisory severity
Critical
CVSS base score
9.1 (Apache), 7.4 (Red Hat)
Weakness
CWE-303
Fixed releases
  • Apache: 11.0.27, 10.1.61, 9.0.123
  • Red Hat: tomcat10-main-10.1.61-0.1.hum1, tomcat11-main-11.0.27-0.1.hum1, RHSA-2026:85926
Vendor advisories
2 from Apache, Red Hat
VulniPulse record
Published · Updated

Scores, vectors, weaknesses and fixed releases are quoted from vendor advisories that cover only CVE-2026-101296; bulletin-wide values are not repeated here.

Is CVE-2026-101296 exploited?

No exploitation is reported in the sources VulniPulse tracks: CVE-2026-101296 is not in the CISA KEV catalog (checked ) and no tracked advisory for it reports exploitation. That is not proof the vulnerability cannot be exploited.

How do I fix CVE-2026-101296?

Upgrade to a fixed release named by the vendor:

  • Apache: 11.0.27, 10.1.61, 9.0.123
  • Red Hat: tomcat10-main-10.1.61-0.1.hum1, tomcat11-main-11.0.27-0.1.hum1, RHSA-2026:85926
  • Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue. (Apache)
  • --- CME Mitigation Guidance (2026-10-20) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to reconfigure Tomcat JNDIRealm to enforce Kerberos GSSAPI authentication and eliminate non-GSSAPI SASL authentication mechanisms: upgrade to Apache Tomcat 11.0.27, 10.1.61, or 9.0.123 (or the fixed Tomcat builds), which verify credentials properly during non-GSSAPI SASL authentication in JNDIRealm, closing unauthenticated request to protected realm using non-GSSAPI SASL credentials. Until patched, this is a concern on Tomcat deployments with JNDIRealm configured with a non-GSSAPI SASL authentication mechanism, so restrict network access to endpoints protected by the JNDI realm and avoid using non-GSSAPI SASL authentication configurations. As a compensating measure, intercept and authenticate inbound requests at an identity-aware gateway before they reach the vulnerable Tomcat JNDI realm. These controls limit blast radius and contain exploitation, but they do not fix the underlying missing critical authentication step defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-201 Zero Trust Gateway / Identity-Aware Proxy (medium) (Red Hat)

Vendor advisory comparison

Apache

1 advisory

Red Hat

1 advisory
  • Advisory severityHigh7.4

    High [CVE-2026-101296] Authentication bypass via non-GSSAPI SASL in JNDI realm

    CVE-2026-101296Source published Source updated

    Authentication bypass via non-GSSAPI SASL in JNDI realm. Red Hat rates this important (CVSS 7.4). Weakness: CWE-303. Red Hat lists fixing advisory RHSA-2026:85926 with package tomcat10-main-10.1.61-0.1.hum1, tomcat11-main-11.0.27-0.1.hum1. Affected product named by the advisory: Red Hat Hardened Images.

    Related products — impact not confirmed
    • Red Hat Hardened Images
    Source-reported affected versions
    Affected-version details not available in this record.
    Source-reported fixed versions
    • tomcat10-main-10.1.61-0.1.hum1
    • tomcat11-main-11.0.27-0.1.hum1
    • RHSA-2026:85926
    Mitigation guidance
    • --- CME Mitigation Guidance (2026-10-20) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to reconfigure Tomcat JNDIRealm to enforce Kerberos GSSAPI authentication and eliminate non-GSSAPI SASL authentication mechanisms: upgrade to Apache Tomcat 11.0.27, 10.1.61, or 9.0.123 (or the fixed Tomcat builds), which verify credentials properly during non-GSSAPI SASL authentication in JNDIRealm, closing unauthenticated request to protected realm using non-GSSAPI SASL credentials. Until patched, this is a concern on Tomcat deployments with JNDIRealm configured with a non-GSSAPI SASL authentication mechanism, so restrict network access to endpoints protected by the JNDI realm and avoid using non-GSSAPI SASL authentication configurations. As a compensating measure, intercept and authenticate inbound requests at an identity-aware gateway before they reach the vulnerable Tomcat JNDI realm. These controls limit blast radius and contain exploitation, but they do not fix the underlying missing critical authentication step defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-201 Zero Trust Gateway / Identity-Aware Proxy (medium)
    Full advisory and evidenceOpen source bulletin

Browse the latest tracked CVEs or the CVEs listed in CISA KEV.

Android app · Google Play

Turn CVE research into alerts on your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features