CVE-2026-76183: Apache Tomcat Auth Bypass Vulnerability

CVE-2026-76183 Overview

CVE-2026-76183 is an Authentication Bypass by Alternate Name vulnerability [CWE-289] in Apache Tomcat. The flaw allows attackers to bypass configured security constraints for any WebSocket endpoint. Unauthenticated remote attackers can access protected WebSocket resources by crafting requests that circumvent identity validation.

The vulnerability affects Apache Tomcat 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, and 9.0.0.M1 through 9.0.121. End-of-support branches 8.5.0 through 8.5.100 and 7.0.43 through 7.0.109 are also affected. Apache released fixes in versions 11.0.26, 10.1.60, and 9.0.122.

Critical Impact
Remote unauthenticated attackers can bypass security constraints on any WebSocket endpoint, exposing protected application functionality across all supported Tomcat branches.

Affected Products

Apache Tomcat 11.0.0-M1 through 11.0.25
Apache Tomcat 10.1.0-M1 through 10.1.59
Apache Tomcat 9.0.0.M1 through 9.0.121 (also affects EOS branches 8.5.0–8.5.100 and 7.0.43–7.0.109)

Discovery Timeline

2026-09-23 - CVE-2026-76183 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-76183

Vulnerability Analysis

Apache Tomcat enforces access rules on protected resources through security constraints defined in web.xml. These constraints are intended to apply uniformly to HTTP and WebSocket endpoints hosted by the container. CVE-2026-76183 breaks that assumption for WebSocket traffic.

Attackers can request a WebSocket endpoint using an alternate resource name that resolves to the same handler but does not match the constraint pattern used during authorization. As a result, Tomcat skips the identity check and connects the client to the endpoint. Any protected function exposed over WebSocket, including administrative messaging, real-time data feeds, or authenticated user actions, becomes reachable without credentials.

The root defect is classified as Authentication Bypass by Alternate Name [CWE-289], where the security decision relies on a canonical form the attacker can avoid.

Root Cause

The WebSocket upgrade path in affected versions performs constraint matching against a resource identifier that is not fully normalized before comparison. Alternate representations of the same endpoint bypass pattern matching yet still reach the intended ServerEndpoint handler. The mismatch between the authorization key and the dispatch key produces the bypass.

Attack Vector

Exploitation requires only network reachability to a Tomcat server that exposes a WebSocket endpoint behind a security constraint. The attacker sends an HTTP Upgrade: websocket request targeting an alternate form of the protected path. Tomcat completes the WebSocket handshake without applying the authorization check, and the attacker interacts with the endpoint as any authenticated client would. No user interaction and no prior credentials are required.

No public proof-of-concept is currently listed for this issue. See the Apache Project Mailing List Post and the Openwall OSS-Security Discussion for the vendor-supplied technical details.

Detection Methods for CVE-2026-76183

Indicators of Compromise

WebSocket handshake requests (GET with Upgrade: websocket) to protected endpoints that return 101 Switching Protocols without a preceding successful authentication event.
Access log entries showing unusual path encodings, trailing characters, or case variations targeting WebSocket URIs mapped to ServerEndpoint classes.
WebSocket sessions originating from source IPs that never completed form-based or BASIC authentication against the application.

Detection Strategies

Correlate authentication events with WebSocket session establishment. Any successful upgrade without a matching authenticated session for the same client should be flagged.
Inspect Tomcat access_log for 101 responses on URIs that resolve to constrained endpoints and compare against configured <security-constraint> patterns in web.xml.
Deploy web application firewall rules that normalize request paths and block WebSocket upgrades whose normalized form differs from the requested form.

Monitoring Recommendations

Enable verbose logging on org.apache.tomcat.websocket and org.apache.catalina.authenticator to capture constraint evaluation decisions.
Alert on spikes in WebSocket connections to endpoints that previously required authentication, especially from unauthenticated sessions.
Track version banners of Tomcat instances across the estate to identify unpatched hosts running 9.0.x, 10.1.x, or 11.0.x below the fixed releases.

How to Mitigate CVE-2026-76183

Immediate Actions Required

Upgrade Apache Tomcat to version 11.0.26, 10.1.60, or 9.0.122 as appropriate for the deployed branch.
Inventory all applications that define @ServerEndpoint classes or <security-constraint> entries covering WebSocket URLs and prioritize those instances.
For end-of-support branches 8.5.x and 7.0.x, migrate to a supported branch since no security fix is provided.

Patch Information

Apache Tomcat 11.0.26, 10.1.60, and 9.0.122 remediate CVE-2026-76183 by aligning WebSocket authorization checks with dispatch resolution. Details are documented in the Apache Project Mailing List Post and the Openwall OSS-Security Discussion.

Workarounds

Front Tomcat with a reverse proxy or web application firewall that normalizes URIs and enforces authentication before forwarding Upgrade: websocket requests.
Temporarily disable WebSocket endpoints that carry sensitive functionality until the patched Tomcat release is deployed.
Restrict network access to Tomcat WebSocket ports so that only authenticated upstream gateways can initiate handshakes.

bash

# Verify the running Tomcat version and confirm it is patched
catalina.sh version | grep 'Server number'
# Expected output should show 11.0.26, 10.1.60, or 9.0.122 or later