CVE-2026-101296: Apache Tomcat Authentication Bypass Vulnerability

CVE-2026-101296 is an authentication bypass flaw in Apache Tomcat that allows attackers to authenticate without correct credentials when JNDI realm is configured with non-GSSAPI SASL mechanisms. This article covers technical details, affected versions, impact assessment, and recommended mitigation steps.

CVE-2026-101296 Overview

CVE-2026-101296 is an authentication bypass vulnerability in Apache Tomcat affecting the JNDI realm when configured with a non-GSSAPI Simple Authentication and Security Layer (SASL) mechanism. The flaw results from a missing critical authentication step [CWE-304], allowing attackers to authenticate without supplying the correct password. The issue affects Apache Tomcat 11.0.0-M1 through 11.0.26, 10.1.0-M1 through 10.1.60, and 9.0.0.M1 through 9.0.122. End-of-life branches 8.5.0 through 8.5.100 and 7.0.0 through 7.0.109 are also known to be affected. Fixed versions are 11.0.27, 10.1.61, and 9.0.123.

Critical Impact
Unauthenticated remote attackers can bypass password verification in Tomcat applications relying on JNDI realm with non-GSSAPI SASL, gaining access to protected resources.

Affected Products

Apache Tomcat 11.0.0-M1 through 11.0.26
Apache Tomcat 10.1.0-M1 through 10.1.60
Apache Tomcat 9.0.0.M1 through 9.0.122 (also EOL 8.5.0-8.5.100 and 7.0.0-7.0.109)

Discovery Timeline

2026-10-20 - CVE-2026-101296 published to the National Vulnerability Database
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-101296

Vulnerability Analysis

The vulnerability resides in the Apache Tomcat JNDIRealm authentication path when administrators configure a non-GSSAPI SASL mechanism for backend directory authentication. During the SASL authentication exchange, the realm fails to perform a required verification step that confirms the supplied credential was accepted by the directory server. As a result, authentication can complete successfully even when the client presents an incorrect password. The outcome is authentication bypass against any web application protected by the affected realm configuration.

Root Cause

The root cause is a missing step in the authentication state machine [CWE-304]. The JNDI realm initiates a SASL bind with the configured mechanism but does not correctly validate the server's authentication outcome before granting access. Because GSSAPI exchanges follow a different code path, only non-GSSAPI SASL deployments are affected. The logic treats the completion of the SASL negotiation as proof of valid credentials rather than evaluating the authoritative result returned by the directory service.

Attack Vector

Exploitation requires network access to the Tomcat instance and knowledge of a valid username. The attacker submits credentials to a protected resource that triggers JNDI realm authentication. Because the realm skips the credential verification step, Tomcat issues a valid authenticated session regardless of password correctness. No prior privileges or user interaction are required. The attack succeeds only against instances configured with the vulnerable JNDI realm and a non-GSSAPI SASL mechanism.

No public proof-of-concept exploit is available. See the Apache Mailing List Thread and the OpenWall OSS Security Update for authoritative technical details.

Detection Methods for CVE-2026-101296

Indicators of Compromise

Successful authentication events in Tomcat access logs for user accounts without corresponding valid credential submissions in the backing directory.
Repeated authentication attempts from a single source against JNDI-protected endpoints followed by successful session establishment.
Directory server logs showing SASL binds that completed without a matching credential verification response.

Detection Strategies

Review server.xml configurations for JNDIRealm entries using a non-GSSAPI SASL mechanism (such as DIGEST-MD5 or CRAM-MD5) and flag instances running vulnerable Tomcat versions.
Correlate Tomcat authentication success events with directory server bind results to identify authentications that lack corresponding verified binds.
Deploy web application firewall rules to log authentication requests to JNDI-protected paths for forensic review.

Monitoring Recommendations

Enable verbose authentication logging in both Tomcat and the backing LDAP or directory service to capture full SASL exchanges.
Alert on authentication to privileged roles from unusual source addresses or user-agents.
Monitor process and configuration changes to Tomcat conf/server.xml and realm definitions.

How to Mitigate CVE-2026-101296

Immediate Actions Required

Upgrade Apache Tomcat to 11.0.27, 10.1.61, or 9.0.123 as applicable to your deployment branch.
Inventory all Tomcat instances and identify any JNDIRealm configurations using non-GSSAPI SASL mechanisms.
Rotate credentials for accounts that authenticate through the affected realm after patching.

Patch Information

The Apache Tomcat project has released fixed versions 11.0.27, 10.1.61, and 9.0.123 that restore the missing authentication verification step. End-of-life branches 8.5.x and 7.0.x will not receive patches; users on these branches must migrate to a supported version. Refer to the Apache Mailing List Thread for the official announcement.

Workarounds

Reconfigure the JNDI realm to use GSSAPI SASL authentication, which is not affected by this vulnerability.
Switch the realm to standard LDAP simple bind authentication over TLS until the patch can be applied.
Restrict network access to Tomcat management and application endpoints to trusted networks only.

bash

# Example: identify vulnerable JNDI realm SASL configuration in server.xml
grep -R "JNDIRealm" /path/to/tomcat/conf/ \
  | grep -Ei "saslQop|DIGEST-MD5|CRAM-MD5"