CVE-2026-55957: Apache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bind
Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.4, from 10.1.0-M1 through 10.1.36, from 9.0.0.M1 through 9.0.100, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.
Users are recommended to upgrade to version 11.0.5, 10.1.37 or 9.0.101, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 11.0.5 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 10.1.37 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 9.0.101
Event History
Frequently Asked Questions
What is the severity of CVE-2026-55957?
The severity of CVE-2026-55957 is rated at 76 on the risk scale, indicating a significant security concern.
How do I fix CVE-2026-55957?
To fix CVE-2026-55957, upgrade Apache Tomcat to version 11.0.5 or later, or 10.1.5 or later.
What versions of Apache Tomcat are affected by CVE-2026-55957?
CVE-2026-55957 affects Apache Tomcat versions from 11.0.0-M1 through 11.0.4 and from 10.1.0-M1 through 10.1.4.
What is the nature of the vulnerability in CVE-2026-55957?
CVE-2026-55957 is an authentication bypass vulnerability that allows attackers to authenticate without providing the correct password.
What is JNDIRealm in relation to CVE-2026-55957?
JNDIRealm is a component in Apache Tomcat that interacts with a Java Naming and Directory Interface, and in this vulnerability, it allowed improper authentication when configured with GSSAPI.