CVE-2026-101296

A flaw was found in Apache Tomcat. When the Java Naming and Directory Interface (JNDI) realm is configured with a non-Generic Security Service Application Program Interface (GSSAPI) Simple Authentication and Security Layer (SASL) mechanism, a missing verification step allows an attacker to bypass authentication without providing the correct password. An unauthenticated remote attacker can exploit this vulnerability to gain unauthorized access to protected resources.

A flaw was found in Apache Tomcat. When the JNDIRealm is configured with a non-GSSAPI SASL authentication mechanism, a missing verification step allows an unauthenticated remote attacker to bypass authentication without supplying valid credentials. Successful exploitation grants unauthorized access to protected web applications and administrative resources hosted on the Tomcat instance, restricted by the operating context and system privileges of the Tomcat process.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

The highest-value action is to reconfigure Tomcat JNDIRealm to enforce Kerberos GSSAPI authentication and eliminate non-GSSAPI SASL authentication mechanisms: upgrade to Apache Tomcat 11.0.27, 10.1.61, or 9.0.123 (or the fixed Tomcat builds), which verify credentials properly during non-GSSAPI SASL authentication in JNDIRealm, closing unauthenticated request to protected realm using non-GSSAPI SASL credentials. Until patched, this is a concern on Tomcat deployments with JNDIRealm configured with a non-GSSAPI SASL authentication mechanism, so restrict network access to endpoints protected by the JNDI realm and avoid using non-GSSAPI SASL authentication configurations. As a compensating measure, intercept and authenticate inbound requests at an identity-aware gateway before they reach the vulnerable Tomcat JNDI realm.