CVE-2026-66422 Overview
CVE-2026-66422 is an improper authorization vulnerability [CWE-285] in Apache Tomcat. The flaw stems from security-role-ref definitions being incorrectly applied as role aliases within the Realm, in addition to their correct usage with Request.isUserInRole(). This behavior allows role references defined at the servlet level to influence authorization decisions across the Realm, breaking the intended isolation between per-servlet role mappings and container-wide authorization.
An authenticated attacker with low privileges can leverage this misconfiguration to gain access to functionality or resources restricted to other roles. The vulnerability affects Apache Tomcat 11.0.0-M1 through 11.0.24, 10.1.0-M1 through 10.1.57, and 9.0.25 through 9.0.120.
Critical Impact
Authenticated users can bypass role-based authorization, resulting in high impact to integrity and availability of protected resources within Tomcat-hosted applications.
Affected Products
- Apache Tomcat 11.0.0-M1 through 11.0.24
- Apache Tomcat 10.1.0-M1 through 10.1.57
- Apache Tomcat 9.0.25 through 9.0.120
- End-of-life versions known to be affected: 8.5.46 through 8.5.100, and 7.0.97 through 7.0.109
Discovery Timeline
- 2026-08-25 - CVE-2026-66422 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-66422
Vulnerability Analysis
Apache Tomcat implements the Java Servlet specification, which defines security-role-ref elements in web.xml. These elements let a servlet declare a role alias that maps a servlet-local role name to a container-wide role name. The mapping is intended to be used only when application code calls Request.isUserInRole(String role).
In affected Tomcat versions, the Realm consults security-role-ref definitions when making broader authorization decisions. This means a servlet-scoped alias can influence whether a user is granted a role for other authorization checks handled by the Realm, expanding effective privileges beyond the servlet that declared the reference.
Exploitation requires an authenticated session and knowledge of the target application's role model. The impact is scoped to integrity and availability of protected resources; confidentiality is not directly affected by the flaw itself.
Root Cause
The root cause is a specification compliance defect. The Servlet specification restricts security-role-ref to the scope of Request.isUserInRole() calls. Tomcat's Realm implementation treated these references as global aliases, extending their effect to authorization checks the Realm performs on incoming requests.
Attack Vector
The attack vector is network-based and requires low privileges but no user interaction. An authenticated attacker submits requests to resources protected by role constraints. When the Realm evaluates authorization, the security-role-ref alias resolves the attacker's assigned role to a privileged role name, granting unintended access.
No verified public proof-of-concept code is available. Refer to the Apache Mailing List Thread and the Openwall OSS Security Update for technical details from the maintainers.
Detection Methods for CVE-2026-66422
Indicators of Compromise
- Successful HTTP requests from low-privilege authenticated users to URL patterns protected by <auth-constraint> role requirements they should not satisfy.
- Unexpected access log entries showing 200 responses on administrative or role-restricted endpoints following authentication by non-privileged accounts.
- Deployed web applications whose web.xml contains security-role-ref elements aliasing sensitive role names such as admin or manager.
Detection Strategies
- Inventory all deployed WAR files and inspect WEB-INF/web.xml for <security-role-ref> blocks that map narrow role names to privileged Realm roles.
- Compare Tomcat server versions against the fixed releases (11.0.25, 10.1.58, 9.0.121) across all hosts.
- Review Realm authorization outcomes for user sessions where the effective role differs from the roles assigned in the identity source.
Monitoring Recommendations
- Enable Tomcat access logging with authenticated user names and correlate against role-restricted URL patterns.
- Forward Tomcat catalina.out and access logs to a centralized analytics platform for role-based access anomaly detection.
- Alert on privilege-tier transitions where users access endpoints outside their assigned application role scope.
How to Mitigate CVE-2026-66422
Immediate Actions Required
- Upgrade Apache Tomcat to version 11.0.25, 10.1.58, or 9.0.121, depending on the branch in use.
- Audit all deployed applications for security-role-ref elements and remove or correct any mapping that references privileged Realm role names.
- Rotate credentials and session tokens for accounts that may have been used to test or exploit unauthorized access.
Patch Information
The Apache Tomcat project has released fixed versions 11.0.25, 10.1.58, and 9.0.121. End-of-life branches 8.5.x and 7.0.x will not receive patches; migrate off these versions. Consult the Apache Mailing List Thread for official release notes.
Workarounds
- Remove <security-role-ref> elements from web.xml where the role alias resolves to a privileged Realm role.
- Restrict network access to Tomcat management interfaces and administrative applications to trusted subnets only.
- Enforce strong role separation by configuring the Realm so that application roles do not overlap with administrative roles.
# Example: verify installed Tomcat version and remove unsafe security-role-ref
$CATALINA_HOME/bin/version.sh
# Inspect deployed applications for security-role-ref definitions
grep -r "security-role-ref" $CATALINA_HOME/webapps/*/WEB-INF/web.xml
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
