CVE-2026-80353

A flaw was found in Apache Tomcat. A local attacker can gain unauthorized access to Unix domain communication sockets due to a time-of-check to time-of-use (TOCTOU) race condition in the APR/Native connector. When the connector initializes a socket, a brief timing window exists before restrictive permissions are applied, allowing an unauthorized local user to connect to the socket and potentially intercept or manipulate local service communications.

A flaw was found in Apache Tomcat. When initializing Unix domain sockets within the APR/Native connector, a time-of-check to time-of-use (TOCTOU) race condition exists before restrictive file permissions are enforced. An authenticated local attacker with shell access to the host system can exploit this timing window to establish an unauthorized connection to the socket, allowing them to intercept or inject data into local inter-process communications handled by the Tomcat daemon, constrained by DAC permissions and SELinux policy boundaries.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Switch affected connectors from APR/Native to the standard NIO connector, or restrict local directory permissions on the socket's parent path to deny unprivileged local users traversal and access.