CVE-2026-43512: Apache Tomcat Auth Bypass Vulnerability

CVE-2026-43512 Overview

CVE-2026-43512 is an authentication bypass vulnerability affecting the digest authentication implementation in Apache Tomcat. The flaw lets unauthenticated attackers bypass digest authentication checks over the network without user interaction, exposing protected resources to compromise. The issue affects Apache Tomcat 11.0.0-M1 through 11.0.21, 10.1.0-M1 through 10.1.54, 9.0.0.M1 through 9.0.117, 8.5.0 through 8.5.100, and versions before 7.0.0. Older unsupported branches may also be affected. The Apache Tomcat project recommends upgrading to 11.0.22, 10.1.55, or 9.0.118, which contain the fix. The Common Weakness Enumeration classification is [CWE-592] (Authentication Bypass Issues).

Critical Impact

Network-reachable attackers can bypass digest authentication on affected Tomcat servers without credentials, compromising confidentiality, integrity, and availability of protected applications.

Affected Products

• Apache Tomcat 11.0.0-M1 through 11.0.21
• Apache Tomcat 10.1.0-M1 through 10.1.54
• Apache Tomcat 9.0.0.M1 through 9.0.117, and 8.5.0 through 8.5.100

Discovery Timeline

• 2026-05-12 - CVE-2026-43512 published to NVD
• 2026-05-15 - Last updated in NVD database

Technical Details for CVE-2026-43512

Vulnerability Analysis

The vulnerability resides in Apache Tomcat's digest authentication handler, which validates HTTP Authorization: Digest headers presented by clients. Digest authentication is a challenge-response scheme defined in RFC 7616, requiring the client to prove knowledge of a credential by combining it with a server-issued nonce and hashing the result. When the validation logic fails to enforce all required parameters or accepts malformed values, an attacker can craft a request that passes the authentication check without possessing valid credentials. The result is unauthenticated access to resources that the application server expects to be protected by digest authentication.

The issue is reachable over the network on any Tomcat connector exposing applications that rely on digest authentication. Exploitation does not require user interaction or elevated privileges, and successful abuse yields the privileges of the authenticated identity the attacker impersonates.

Root Cause

The root cause is improper verification of the digest authentication response, mapped to [CWE-592]. The authentication routine returns a successful state along a code path where one or more critical inputs — such as the nonce, qop value, nc counter, or computed response hash — are not validated against the expected server-side state. This allows attacker-supplied values to satisfy the check without producing a cryptographically correct response derived from a real password.

Attack Vector

An unauthenticated remote attacker sends a crafted HTTP request with a manipulated Authorization: Digest header to a Tomcat endpoint that uses digest authentication. The malformed or replayed digest values bypass the verification logic, and Tomcat treats the request as authenticated. The attacker then accesses protected servlets, JSP resources, manager interfaces, or APIs configured with the DigestAuthenticator realm. No specific code example is published for this advisory. See the Apache Mailing List Discussion and the OpenWall OSS Security Update for technical details.

Detection Methods for CVE-2026-43512

Indicators of Compromise

• HTTP requests containing Authorization: Digest headers with missing, empty, or repeated nonce, nc, or response fields reaching Tomcat connectors.
• Successful access log entries (HTTP 200/302) on resources protected by digest authentication without preceding 401 challenge round trips.
• Authentication success events for user principals that did not perform a corresponding interactive login.
• Unexpected access to administrative paths such as /manager/html or /host-manager/ from external source addresses.

Detection Strategies

• Inspect localhost_access_log and reverse proxy logs for digest-authenticated requests that lack a paired 401 Unauthorized challenge from the same client session.
• Alert on HTTP requests where the Authorization header value deviates from RFC 7616 structure, including duplicated parameters or absent response tokens.
• Correlate Tomcat realm authentication success events with source IP reputation and geolocation to surface anomalous logins.

Monitoring Recommendations

• Enable verbose logging on org.apache.catalina.authenticator.DigestAuthenticator to capture nonce issuance and validation outcomes.
• Forward Tomcat access and catalina logs to a centralized SIEM with parsing rules for digest authentication fields.
• Monitor for spikes in authenticated traffic to applications that historically receive low request volumes.

How to Mitigate CVE-2026-43512

Immediate Actions Required

• Upgrade to Apache Tomcat 11.0.22, 10.1.55, or 9.0.118 on all affected servers, including non-production environments.
• Inventory all Tomcat instances and identify applications configured with <auth-method>DIGEST</auth-method> in web.xml.
• Restrict network exposure of management interfaces to trusted administrative networks until patching is complete.
• Rotate credentials for any accounts that may have been exposed through digest-protected endpoints.

Patch Information

The Apache Tomcat project has released fixed versions 11.0.22, 10.1.55, and 9.0.118. Tomcat 8.5.x and 7.x are end-of-life and will not receive patches; migrate workloads on these branches to a supported version. Patch details are available in the Apache Mailing List Discussion.

Workarounds

• Switch the application authentication method from DIGEST to BASIC over TLS or to FORM with a hardened login flow until the patch is applied.
• Place an authenticating reverse proxy in front of Tomcat to terminate authentication before requests reach the affected handler.
• Apply network ACLs to limit access to Tomcat connectors that serve digest-protected applications.

# Configuration example: disable digest authentication in web.xml
# Replace the <login-config> block with BASIC over HTTPS
<login-config>
  <auth-method>BASIC</auth-method>
  <realm-name>Protected Area</realm-name>
</login-config>