CVE-2026-66422: Apache Tomcat: Servlet role references can bypass declarative role constraints
Improper Authorization vulnerability in Apache Tomcat cause by security-role-ref definitions being incorrectly used as role aliases within the Realm in additional to the correct usage with Request.isUserInRole().
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.25 through 9.0.120.
The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.46 through 8.5.100, from 7.0.97 through 7.0.109. Other unsupported versions may also be affected.
Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 11.0.25 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 10.1.58 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 9.0.121
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using affected Apache Tomcat versions are exposed when their application configuration includes security-role-ref definitions. The issue affects supported version ranges through 11.0.24, 10.1.57, and 9.0.120, as well as known affected EOL ranges for 8.5 and 7.0.
What configuration condition enables the authorization bypass?
The issue arises because security-role-ref definitions are incorrectly treated as role aliases within the Realm, beyond their intended use with Request.isUserInRole(). Applications without relevant security-role-ref definitions are not identified in the provided information as affected by this behavior.
How should affected Tomcat installations be remediated?
Upgrade to Apache Tomcat 11.0.25, 10.1.58, or 9.0.121, depending on the deployed major release. These versions fix the issue.
Are unsupported Tomcat releases potentially affected?
Yes. Tomcat 8.5.46 through 8.5.100 and 7.0.97 through 7.0.109 were EOL but known to be affected when the CVE was created, and other unsupported versions may also be affected.