CVE-2026-55957: high-severity vulnerability in Apache Tomcat
Apache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bind
Published · Updated
41Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 7.3epss 2.9%
from disclosure to weapon39 days
Published on NVDJun 29
1st PoC+39d
exploitation probability
2.9%top 14% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.4, from 10.1.0-M1 through 10.1.36, from 9.0.0.M1 through 9.0.100, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.
Users are recommended to upgrade to version 11.0.5, 10.1.37 or 9.0.101, which fixes the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Affected products
Apache Software Foundation · Apache Tomcatpublic PoCs found — 1
githubgithub.com/mdvpat/CVE-2026-55957-PoC★ 0⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Apache Tomcat
In the same product, most dangerous first.
CVE-2017-12617HIGHCVE-2017-12617EPSS 100.0%KEVCVE-2025-24813CRITICALApache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUTEPSS 99.9%KEVCVE-2017-12615HIGHCVE-2017-12615EPSS 99.6%KEVCVE-2016-8735CRITICALCVE-2016-8735EPSS 90.3%KEVCVE-2026-34486HIGHApache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptorEPSS 6.6%KEVCVE-2018-11784—CVE-2018-11784EPSS 97.7%