CVE-2026-59083: Apache Tomcat Auth Bypass Vulnerability

CVE-2026-59083 Overview

CVE-2026-59083 is a security constraint bypass vulnerability in Apache Tomcat's rewrite valve. The flaw stems from improper handling of URL hex encoding [CWE-177], which allows attackers to craft requests that evade configured security constraints in some deployments. Apache Tomcat is one of the most widely deployed Java servlet containers, making this issue relevant to a large population of enterprise web applications.

Attackers can exploit the flaw remotely over the network without authentication or user interaction. Successful exploitation can expose protected resources and enable unauthorized modification of application data behind the affected constraints.

Critical Impact
Remote, unauthenticated attackers can bypass security constraints enforced through the rewrite valve, exposing restricted endpoints to unauthorized access and modification.

Affected Products

Apache Tomcat 11.0.0-M1 through 11.0.23
Apache Tomcat 10.1.0-M1 through 10.1.56
Apache Tomcat 9.0.0.M1 through 9.0.119
Apache Tomcat 8.5.0 through 8.5.100 (end-of-support versions may also be affected)

Discovery Timeline

2026-07-14 - CVE-2026-59083 published to the National Vulnerability Database (NVD)
2026-07-14 - Apache project coordinated disclosure via the Apache Mailing List Thread and OpenWall OSS Security Update
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-59083

Vulnerability Analysis

The vulnerability resides in the Apache Tomcat rewrite valve, a component that performs URL rewriting similar to Apache HTTPD's mod_rewrite. The rewrite valve executes before servlet-level security constraint checks and normalizes request URIs for pattern matching. Improper handling of hex-encoded characters in the URI causes divergence between the path evaluated by the rewrite logic and the path enforced by security constraints.

Attackers can craft URIs where percent-encoded octets are decoded inconsistently across processing stages. The rewrite valve may treat the request as targeting an unprotected path, while the underlying servlet receives a resolved path pointing to a protected resource. This mismatch allows requests to reach endpoints that the deployment intended to restrict.

The impact varies by configuration. Deployments using the rewrite valve alongside <security-constraint> elements in web.xml, or Tomcat's RemoteAddrValve and role-based access, are most exposed. Because Tomcat frequently fronts internal APIs and admin consoles, bypass can expose sensitive functions to the public internet.

Root Cause

The root cause is classified under [CWE-177] Improper Handling of URL Encoding (Hex Encoding). The rewrite valve fails to canonicalize hex-encoded characters consistently before applying rewrite rules and passing the request downstream. This creates a parser differential between the security enforcement layer and request dispatch.

Attack Vector

Exploitation requires only network access to a Tomcat instance that has the rewrite valve enabled and configured to enforce or route security-sensitive paths. An attacker sends an HTTP request whose URI contains hex-encoded characters chosen to defeat the rewrite normalization. No credentials or user interaction are required. The vulnerability does not directly compromise availability, but confidentiality and integrity of protected resources are at risk.

Refer to the Apache Mailing List Thread for the official technical description. No public proof-of-concept exploit was available at the time of publication.

Detection Methods for CVE-2026-59083

Indicators of Compromise

HTTP request logs containing percent-encoded characters (for example %2e, %2f, %25) in URIs that target paths normally protected by security constraints.
Access log entries showing HTTP 200 responses to restricted endpoints from unauthenticated or unexpected source addresses.
Rewrite valve logs showing rule matches for URIs whose decoded form differs from the matched pattern.

Detection Strategies

Compare Tomcat access_log entries against the paths enumerated in web.xml security constraints and alert on successful requests to protected URIs that lack an associated authenticated session.
Deploy WAF or reverse proxy rules that reject or canonicalize double-encoded and mixed-case hex sequences before requests reach Tomcat.
Review rewrite.config files for rules whose pattern matching depends on decoded path segments and validate behavior with encoded inputs.

Monitoring Recommendations

Enable verbose logging on the rewrite valve to capture both the raw request URI and the rewritten target for anomaly analysis.
Ingest Tomcat access, catalina, and rewrite logs into a centralized SIEM and correlate constraint-protected paths with authentication events.
Baseline the volume of hex-encoded URIs per endpoint and alert on statistically significant spikes.

How to Mitigate CVE-2026-59083

Immediate Actions Required

Upgrade Apache Tomcat to a fixed release: 11.0.24, 10.1.57, or 9.0.120.
Inventory all Tomcat instances, including embedded deployments in Spring Boot and vendor appliances, and confirm whether the rewrite valve is enabled.
Restrict network exposure of administrative and internal Tomcat endpoints while patches are staged.

Patch Information

The Apache Tomcat project has released patched versions 11.0.24, 10.1.57, and 9.0.120 that correct the URL encoding handling in the rewrite valve. Users on the unsupported 8.5.x line should migrate to a supported release, as fixes are not guaranteed. See the Apache Mailing List Thread for the official advisory and the OpenWall OSS Security Update for distribution notifications.

Workarounds

Disable the rewrite valve in server.xml if the deployment does not require URL rewriting, and enforce routing through servlet mappings only.
Front Tomcat with a reverse proxy such as nginx, Apache HTTPD, or a WAF that canonicalizes and validates URIs before forwarding requests.
Simplify rewrite rules to avoid patterns that depend on encoded characters, and duplicate any security-sensitive path restrictions at the reverse proxy layer.

bash

# Verify installed Tomcat version and plan upgrade
$CATALINA_HOME/bin/version.sh

# Example: comment out the rewrite valve in $CATALINA_BASE/conf/server.xml
# <Valve className="org.apache.catalina.valves.rewrite.RewriteValve" />

# Reverse proxy hardening example (nginx) to reject double-encoded paths
# location / {
#     if ($request_uri ~* "%25") { return 400; }
#     proxy_pass http://tomcat_upstream;
# }