CVE-2026-25854: Apache Tomcat Open Redirect Vulnerability

CVE-2026-25854 Overview

CVE-2026-25854 is an Open Redirect vulnerability affecting Apache Tomcat's LoadBalancerDrainingValve component. This vulnerability allows attackers to craft malicious URLs that redirect users to untrusted external sites, potentially facilitating phishing attacks, credential theft, or malware distribution.

The LoadBalancerDrainingValve is commonly used in enterprise deployments to gracefully handle server maintenance scenarios by redirecting traffic away from nodes being drained. However, occasional improper validation of redirect destinations enables attackers to abuse this functionality for malicious purposes.

Critical Impact

Attackers can leverage this open redirect vulnerability to craft convincing phishing URLs using trusted Apache Tomcat domains, potentially leading to credential theft or malware delivery to unsuspecting users.

Affected Products

• Apache Tomcat 11.0.0-M1 through 11.0.18
• Apache Tomcat 10.1.0-M1 through 10.1.52
• Apache Tomcat 9.0.0.M23 through 9.0.115
• Apache Tomcat 8.5.30 through 8.5.100

Discovery Timeline

• 2026-04-09 - CVE CVE-2026-25854 published to NVD
• 2026-04-09 - Last updated in NVD database

Technical Details for CVE-2026-25854

Vulnerability Analysis

This vulnerability is classified as CWE-601 (URL Redirection to Untrusted Site, also known as Open Redirect). The flaw exists within the LoadBalancerDrainingValve component of Apache Tomcat, which is designed to redirect requests during server draining operations in load-balanced environments.

The vulnerability occurs occasionally during redirect operations, suggesting a race condition or edge case in the URL validation logic. When exploited, the valve fails to properly validate the destination URL, allowing an attacker to craft requests that redirect users to arbitrary external domains.

Open redirect vulnerabilities are particularly dangerous because they abuse the trust users place in legitimate domains. An attacker can create a URL pointing to a trusted Apache Tomcat server that ultimately redirects victims to a malicious site designed to harvest credentials or distribute malware.

Root Cause

The root cause lies in insufficient validation of redirect target URLs within the LoadBalancerDrainingValve component. The valve occasionally fails to verify that redirect destinations are within the expected trusted domain scope, allowing external URLs to be specified as redirect targets. This may be related to specific timing conditions or edge cases in how the valve processes certain request patterns during draining operations.

Attack Vector

The attack vector for CVE-2026-25854 involves crafting malicious URLs that leverage the LoadBalancerDrainingValve functionality. An attacker can construct a URL pointing to a legitimate Apache Tomcat server that includes a redirect parameter pointing to an external malicious domain.

The attacker distributes these crafted URLs through phishing emails, social media, or compromised websites. When a victim clicks the link, they initially connect to the trusted Tomcat server. The LoadBalancerDrainingValve then processes the redirect, sending the user to the attacker-controlled destination.

This attack is particularly effective because:

• The initial URL points to a legitimate, trusted domain
• Security tools may not flag the URL as malicious
• Users see the trusted domain and are more likely to click
• The redirect happens transparently, often without user awareness

For technical details regarding the specific URL parameters and exploitation methodology, refer to the Apache Security Thread Discussion.

Detection Methods for CVE-2026-25854

Indicators of Compromise

• Unusual redirect activity from the LoadBalancerDrainingValve to external domains
• Access logs showing requests with external URLs in redirect-related parameters
• Reports from users being redirected to unexpected or malicious websites after visiting your Tomcat-hosted applications
• Security tool alerts for outbound redirects to known malicious domains

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block requests containing external URLs in redirect parameters
• Configure intrusion detection systems (IDS) to monitor for suspicious redirect patterns in HTTP responses
• Review Apache Tomcat access logs for requests involving the LoadBalancerDrainingValve that result in redirects to non-whitelisted domains
• Deploy URL filtering solutions to identify potential open redirect exploitation attempts

Monitoring Recommendations

• Enable detailed access logging for all Tomcat instances using the LoadBalancerDrainingValve
• Set up alerts for HTTP 302/301 responses that redirect to domains outside your organization's whitelist
• Monitor security feeds and threat intelligence for exploitation attempts targeting this CVE
• Conduct regular security audits of Tomcat configurations and valve settings

How to Mitigate CVE-2026-25854

Immediate Actions Required

• Upgrade Apache Tomcat to version 11.0.20, 10.1.53, or 9.0.116 immediately
• If running version 8.5.x, evaluate upgrade paths as the fix versions for this branch should be verified against the official Apache advisory
• Review current LoadBalancerDrainingValve configurations for unnecessary exposure
• Implement URL validation at the application layer as defense-in-depth

Patch Information

Apache has released patched versions that address this open redirect vulnerability:

Users should upgrade to the appropriate fixed version for their deployment. The Apache Software Foundation notes that other unsupported versions may also be affected. Organizations running end-of-life Tomcat versions should plan migration to supported releases.

For the official security advisory and upgrade instructions, see the Apache Security Thread Discussion.

Workarounds

• If the LoadBalancerDrainingValve is not required for your deployment, consider disabling or removing it from your Tomcat configuration
• Implement strict URL validation at a reverse proxy or WAF level to only allow redirects to whitelisted internal domains
• Configure Content Security Policy (CSP) headers to restrict navigation targets where applicable
• Deploy network-level controls to monitor and alert on unexpected outbound redirects from Tomcat servers

<!-- Example: Remove or comment out LoadBalancerDrainingValve if not needed -->
<!-- In server.xml, locate and remove/comment the following if present: -->
<!--
<Valve className="org.apache.catalina.valves.LoadBalancerDrainingValve"
       redirectStatusCode="303"
       ignoreCookieName="JSESSIONID"
       ignoreCookieValue="ignore"/>
-->