CVE-2026-68569: Apache Tomcat Auth Bypass Vulnerability

CVE-2026-68569 Overview

CVE-2026-68569 is an improper authentication vulnerability in Apache Tomcat affecting the DataSourceRealm component. Under specific authentication configurations such as CLIENT-CERT or SPNEGO, Tomcat can authenticate a user even when that user does not exist in the configured DataSourceRealm. Attackers with valid client credentials for one authentication mechanism can gain access to resources without a corresponding realm entry. The flaw is tracked under CWE-287: Improper Authentication and impacts long-standing Tomcat 9, 10, and 11 branches.

Critical Impact
An attacker presenting a valid client certificate or Kerberos ticket can bypass realm-based user validation and access protected applications on affected Tomcat servers.

Affected Products

Apache Tomcat 11.0.0-M1 through 11.0.24
Apache Tomcat 10.1.0-M1 through 10.1.57
Apache Tomcat 9.0.0.M1 through 9.0.120
End-of-life branches known to be affected: 8.5.0 through 8.5.100 and 7.0.0 through 7.0.109

Discovery Timeline

2026-08-25 - CVE-2026-68569 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-68569

Vulnerability Analysis

Apache Tomcat's DataSourceRealm looks up user records and role assignments from a relational database via a JDBC DataSource. When Tomcat is configured with authenticators that perform identity verification outside the realm, such as CLIENT-CERT (mutual TLS) or SPNEGO (Kerberos), the authenticator establishes the principal before the realm confirms the user exists in the backing database.

The defect causes Tomcat to complete authentication even when the realm returns no matching user. Applications relying on DataSourceRealm to enforce user existence and role assignment therefore accept principals that were never provisioned in the database. Role-based access checks that depend on realm data may fail open for these unknown users.

Root Cause

The root cause is a control-flow defect in the interaction between the authenticator (CLIENT-CERT, SPNEGO) and DataSourceRealm. The realm should reject any principal that has no matching row in the users table, but under these configurations the negative lookup result does not terminate the authentication flow. The issue falls under CWE-287: Improper Authentication.

Attack Vector

An attacker with a certificate signed by a trusted certificate authority, or a valid Kerberos ticket in a trusted realm, can authenticate to a vulnerable Tomcat instance even if no corresponding database user exists. The attack requires network access to the Tomcat connector and possession of credentials accepted by the external authentication mechanism. See the Apache Tomcat mailing list announcement and the Openwall OSS-Security post for vendor detail.

No public proof-of-concept code has been released for this vulnerability. Refer to the vendor advisory for technical specifics on the affected code paths.

Detection Methods for CVE-2026-68569

Indicators of Compromise

Successful authentication events in Tomcat access logs for principals that have no matching row in the DataSourceRealm users table.
CLIENT-CERT or SPNEGO authentication entries followed by requests to protected paths without prior role assignment records.
Application-layer session creation for usernames that fail lookups in downstream database queries.

Detection Strategies

Correlate Tomcat authenticator logs (org.apache.catalina.authenticator.*) with DataSourceRealm SQL activity to identify authentications with no matching realm query result.
Enable DEBUG logging for org.apache.catalina.realm.DataSourceRealm and alert on authenticate calls that succeed despite empty result sets.
Review application authorization decisions for principals whose usernames do not appear in the users table.

Monitoring Recommendations

Ingest Tomcat access, catalina, and realm logs into a centralized log platform for correlation with database query logs.
Baseline the expected set of authenticated principals per application and alert on unknown usernames reaching protected contexts.
Monitor certificate authorities and Kerberos KDCs for credential issuance that does not correspond to provisioned application users.

How to Mitigate CVE-2026-68569

Immediate Actions Required

Upgrade Apache Tomcat to version 11.0.25, 10.1.58, or 9.0.121 on all affected hosts.
Retire end-of-life 8.5.x and 7.0.x deployments; they are known affected and will not receive fixes.
Audit server.xml and context configurations for CLIENT-CERT and SPNEGO authenticators paired with DataSourceRealm.
Review authentication logs for the past 90 days to identify principals that never existed in the realm database.

Patch Information

Apache has released fixed versions 11.0.25, 10.1.58, and 9.0.121. Details are available in the Apache Tomcat security announcement and the Openwall OSS-Security post. Apply the patched release that matches your current major branch and restart the Tomcat service to load the corrected realm logic.

Workarounds

Replace DataSourceRealm with a CombinedRealm or LockOutRealm wrapping a realm that strictly enforces user existence, until patches can be applied.
Constrain the trust store used by CLIENT-CERT connectors to a certificate authority that issues certificates only for provisioned application users.
Restrict SPNEGO acceptance to Kerberos principals whose account names are guaranteed to exist in the DataSourceRealm users table.

bash

# Verify running Tomcat version after applying the patch
$CATALINA_HOME/bin/version.sh

# Expected output should show one of the fixed versions:
# Server number:  11.0.25.0
# Server number:  10.1.58.0
# Server number:  9.0.121.0