CVE-2026-65182: Apache Tomcat Auth Bypass Vulnerability

CVE-2026-65182 Overview

CVE-2026-65182 is an improper access control vulnerability in Apache Tomcat that allows attackers to bypass security constraints. The flaw occurs when a security constraint for a longer path is declared before a more restrictive constraint for a shorter sub-path. Tomcat evaluates the constraints in declaration order, so the broader rule wins and the stricter sub-path rule is never enforced. Unauthenticated remote attackers can reach protected resources over the network without user interaction. The issue affects Apache Tomcat 7.0.0 through 11.0.24 across five major release branches. Apache classifies the vulnerability under CWE-284: Improper Access Control.

Critical Impact
Remote attackers can access resources protected by web application security constraints without authentication, exposing confidential data and administrative functions.

Affected Products

Apache Tomcat 11.0.0-M1 through 11.0.24
Apache Tomcat 10.1.0-M1 through 10.1.57, and 9.0.0.M1 through 9.0.120
Apache Tomcat 8.5.0 through 8.5.100, and 7.0.0 through 7.0.109

Discovery Timeline

2026-08-25 - CVE-2026-65182 published to NVD
2026-08-26 - Apache publishes advisory via the Apache Mailing List Thread and Openwall OSS-Security Update
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-65182

Vulnerability Analysis

Apache Tomcat enforces declarative access control through <security-constraint> elements defined in web.xml. Each constraint binds a URL pattern to authentication and authorization rules. The container matches incoming requests against these patterns to decide whether the request is permitted, denied, or requires authentication.

The vulnerability arises from the order Tomcat uses to evaluate overlapping constraints. When a constraint covering a longer path pattern is declared before a more restrictive constraint for a shorter sub-path, Tomcat applies the earlier, broader rule and skips the stricter one. As a result, resources intended to be protected by the more restrictive sub-path constraint become reachable.

Attackers exploit this by requesting protected URLs that should be blocked by the stricter constraint. The request matches the earlier permissive rule instead, bypassing authentication or role checks entirely. Exploitation requires only network access and a well-formed HTTP request.

Root Cause

The root cause is incorrect authorization logic in the constraint matching engine. Tomcat does not select the most specific matching constraint when overlapping rules exist. Instead, it honors declaration order, contradicting the principle of least privilege that administrators expect when writing web.xml policies.

Attack Vector

The attack vector is network-based, requires no privileges, and requires no user interaction. An attacker sends HTTP or HTTPS requests to URLs governed by a shadowed security constraint. Because the container skips the restrictive rule, the request is served without authentication or role enforcement, disclosing data or invoking privileged application functionality.

No verified exploit code is public. Refer to the Apache Mailing List Thread for the official technical description.

Detection Methods for CVE-2026-65182

Indicators of Compromise

Successful HTTP 200 responses to protected URL patterns from clients that did not complete authentication
Access log entries for administrative or restricted sub-paths without a preceding session or login event
Repeated requests probing multiple sub-paths under a common parent path shortly after reconnaissance scans

Detection Strategies

Audit deployed web.xml files for overlapping <security-constraint> blocks where a longer url-pattern is declared before a shorter, more restrictive one
Correlate web access logs against authentication logs to identify requests reaching protected resources without a valid session
Deploy runtime request replay tests against staging environments to confirm which URLs enforce authentication

Monitoring Recommendations

Forward Tomcat access logs and application authentication events to a centralized analytics platform for cross-source correlation
Alert on anonymous access to URL patterns that match sensitive prefixes such as /admin, /manager, or /api/internal
Track the running Tomcat version across the fleet and flag hosts remaining on 7.0.x, 8.5.x, 9.0.x through 9.0.120, 10.1.x through 10.1.57, and 11.0.x through 11.0.24

How to Mitigate CVE-2026-65182

Immediate Actions Required

Upgrade Apache Tomcat to 11.0.25, 10.1.58, or 9.0.121 as recommended by the Apache Tomcat project
Inventory all Tomcat instances, including embedded and containerized deployments, and prioritize internet-facing hosts
Review each application's web.xml and reorder <security-constraint> declarations so that more restrictive sub-path rules precede broader parent-path rules

Patch Information

Apache Tomcat 11.0.25, 10.1.58, and 9.0.121 contain the fix. Tomcat 8.5.x and 7.0.x branches are affected up to 8.5.100 and 7.0.109 respectively; both branches have reached end of life, so migration to a supported branch is required. See the Apache Mailing List Thread and Openwall OSS-Security Update for the authoritative release notes.

Workarounds

Reorder <security-constraint> entries in web.xml so that the most specific and restrictive URL patterns appear first
Place a reverse proxy or web application firewall in front of Tomcat to enforce authentication on sensitive URL prefixes independently of the container
Restrict network access to Tomcat management and administrative contexts to trusted source ranges until patches are applied

bash

# Example: verify installed Tomcat version and prioritize upgrades
$CATALINA_HOME/bin/version.sh | grep -i 'server number'

# Example: enforce authentication at a reverse proxy for a restricted sub-path
# nginx configuration snippet
location /app/admin/ {
    auth_request /_auth;
    proxy_pass http://tomcat_backend;
}