CVE-2026-15554: Undertow AJP Auth Bypass Vulnerability

CVE-2026-15554 Overview

CVE-2026-15554 is an authentication bypass vulnerability in the Undertow Apache JServ Protocol (AJP) listener. The listener trusts forged ssl_cert and is_ssl AJP attributes without requiring shared-secret authentication. An unauthenticated attacker with direct TCP access to port 8009 can inject a forged X.509 certificate through the AJP protocol. This bypasses CLIENT-CERT authentication and grants access as any identity the attacker chooses to impersonate. The flaw is categorized under [CWE-295] Improper Certificate Validation and impacts confidentiality and integrity of applications relying on AJP-based mutual TLS authentication.

Critical Impact
Unauthenticated attackers reachable on TCP port 8009 can impersonate arbitrary users by injecting a forged client certificate through AJP, bypassing CLIENT-CERT authentication entirely.

Affected Products

Undertow web server (AJP listener component)
Red Hat JBoss Enterprise Application Platform distributions referenced in RHSA-2026:53644
Red Hat JBoss Enterprise Application Platform distributions referenced in RHSA-2026:53806

Discovery Timeline

2026-08-11 - CVE-2026-15554 published to the National Vulnerability Database
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-15554

Vulnerability Analysis

Undertow exposes an AJP connector, typically bound to TCP port 8009, that accepts protocol requests from reverse proxies such as Apache HTTP Server or NGINX. The AJP protocol allows the front-end proxy to forward request metadata to the back-end, including TLS attributes like is_ssl and the client certificate presented during mutual TLS negotiation.

The listener accepts these attributes as authoritative without validating their origin. When a Jakarta EE application is configured with CLIENT-CERT authentication, the container reads the forwarded certificate and treats it as evidence of a completed mutual TLS handshake. An attacker who can reach the AJP port directly can construct AJP messages containing arbitrary values for these attributes and gain authenticated access as any subject encoded in the forged certificate.

Root Cause

The root cause is missing peer authentication on the AJP transport. Tomcat and modern AJP implementations require a secret (shared password) on the connector so only trusted proxies can populate sensitive request attributes. Undertow's AJP listener honored ssl_cert and is_ssl without enforcing such a shared secret, violating the certificate validation contract described in [CWE-295].

Attack Vector

Exploitation requires network reachability to the AJP port, typically 8009. The attacker crafts an AJP/1.3 Forward Request packet, sets the is_ssl flag to true, and supplies a self-generated X.509 certificate in the SSL_CERT request attribute. Undertow forwards the request to the target Jakarta EE application, which reads the certificate through the standard servlet API and authorizes the session against its security constraints. No credentials, no valid TLS handshake, and no user interaction are required. Refer to the Red Hat CVE analysis for protocol-level detail.

Detection Methods for CVE-2026-15554

Indicators of Compromise

Inbound TCP connections to port 8009 originating from hosts other than the sanctioned reverse proxy fleet.
Application authentication logs showing CLIENT-CERT logins for user identities that never performed an interactive TLS handshake.
AJP Forward Request packets carrying SSL_CERT attributes with issuer or subject fields not present in the organization's public key infrastructure.

Detection Strategies

Monitor NetFlow or firewall logs for any process outside the proxy tier initiating connections to AJP listener ports.
Correlate web-tier access logs with back-end authentication events to identify sessions where a certificate was accepted without a preceding TLS session on the front-end proxy.
Enable Undertow access logging with the remote user and authentication scheme fields, then alert on CLIENT-CERT authentications from unexpected source addresses.

Monitoring Recommendations

Ingest Undertow, reverse proxy, and firewall logs into a centralized analytics platform to enable cross-tier correlation of AJP traffic.
Baseline the set of source IPs that legitimately speak AJP to the application server and alert on any deviation.
Track successful CLIENT-CERT authentications per identity and flag statistically anomalous spikes for review.

How to Mitigate CVE-2026-15554

Immediate Actions Required

Restrict AJP listener exposure with host firewall rules so only the reverse proxy tier can reach port 8009.
Apply the vendor patches referenced in RHSA-2026:53644 and RHSA-2026:53806 as soon as maintenance windows allow.
Audit Undertow AJP configurations for a configured shared secret and disable the listener where AJP is not required.

Patch Information

Red Hat has released fixed packages for affected JBoss Enterprise Application Platform distributions. Refer to RHSA-2026:53644, RHSA-2026:53806, the Red Hat CVE page, and Red Hat Bugzilla #2480601 for exact package versions and errata metadata.

Workarounds

Disable the AJP listener in Undertow configuration if the deployment fronts HTTP/HTTPS directly and does not require AJP.
Bind the AJP listener to a loopback or private interface reachable only from the sanctioned reverse proxy hosts.
Configure a strong shared secret on the AJP connector and mirror the same secret on the upstream proxy so unauthenticated AJP packets are rejected.

bash

# Example: block external access to the AJP port with iptables
iptables -A INPUT -p tcp --dport 8009 -s <proxy_ip>/32 -j ACCEPT
iptables -A INPUT -p tcp --dport 8009 -j DROP