~/f4n6 $ grep -r "CVE-2026-34486 Apache Tomcat: Apache Tomcat Missing Encryption of Sensitive Data Vulnerability" ./investigations/ --include="*.md"

CVE-2026-34486 Apache Tomcat: Apache Tomcat Missing Encryption of Sensitive Data Vulnerability

Jeff Davies 05 Aug 2026 6 min read

1. Executive summary

CVE-2026-34486 is a missing encryption of sensitive data vulnerability (CVSS 7.5 HIGH) in Apache Tomcat, arising because the fix for CVE-2026-29146 inadvertently allows bypass of the EncryptInterceptor. The flaw affects Tomcat 11.0.20, 10.1.53, and 9.0.116, enabling a remote, unauthenticated attacker to read sensitive data transmitted over the cluster channel in cleartext. CISA added the CVE to its Known Exploited Vulnerabilities (KEV) catalogue on 2026-08-04 with a remediation due date of 2026-08-07, confirming active exploitation. EMEA financial services running affected Tomcat versions with EncryptInterceptor enabled face immediate risk of confidentiality breach on internal cluster traffic.

2. Regulatory framing

Article Trigger (the fact in this item) Practical impact
DORA Art. 19 — reporting of major ICT-related incidents to competent authorities CISA KEV confirms active exploitation of a vulnerability affecting confidentiality of cluster communications; a confirmed compromise of Tomcat EncryptInterceptor would constitute a major ICT-related incident requiring classification and reporting. If exploitation is detected on in-scope systems, trigger incident classification under Art. 18 and report to competent authorities under Art. 19 timelines.
DORA Art. 24 — digital operational resilience testing — general requirements The vulnerability is a regression introduced by a prior patch (CVE-2026-29146 fix), demonstrating that patch application without regression testing can degrade operational resilience. Incorporate EncryptInterceptor bypass testing into post-patch verification for Tomcat cluster deployments.

3. Technical analysis & attack chain

Affected versions

  • Apache Tomcat 11.0.20
  • Apache Tomcat 10.1.53
  • Apache Tomcat 9.0.116

Fixed versions

  • Apache Tomcat 11.0.21
  • Apache Tomcat 10.1.54
  • Apache Tomcat 9.0.117

Vulnerability mechanism

CVE-2026-34486 is a regression vulnerability. The fix for CVE-2026-29146 — a prior vulnerability in Apache Tomcat — introduced a flaw that allows an attacker to bypass the EncryptInterceptor. The EncryptInterceptor is a Tomcat cluster component responsible for encrypting inter-node replication traffic. When enabled, it is expected to provide confidentiality for sensitive data transmitted between cluster nodes (e.g., session replication data). The bypass means that traffic intended to be encrypted can be transmitted in cleartext, exposing session data, application state, and other replicated content to network-level interception.

CWE classification: CWE-311 (Missing Encryption of Sensitive Data) per Apache Software Foundation; CWE-807 (Reliance on Untrusted Inputs in a Security Decision) per Red Hat. Both classifications describe the same underlying flaw from different perspectives — the encryption is absent (CWE-311) because the interceptor's trust/encryption decision can be circumvented (CWE-807).

CVSS: 7.5 HIGH — Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. Network-exploitable, low attack complexity, no privileges or user interaction required. Impact is confined to confidentiality (high); no integrity or availability impact.

Attack chain (confirmed steps)

  1. Reconnaissance: Attacker identifies a target deployment running Apache Tomcat versions 11.0.20, 10.1.53, or 9.0.116 with cluster replication enabled and EncryptInterceptor configured.
  2. Network positioning: Attacker gains a position on the network path between Tomcat cluster nodes (e.g., via ARP spoofing, compromised network device, or co-tenant cloud network access) or accesses the cluster multicast/unicast traffic directly.
  3. Encryption bypass: Due to the regression from the CVE-2026-29146 fix, the EncryptInterceptor fails to enforce encryption on inter-node replication traffic. The attacker observes cleartext transmission of sensitive cluster data.
  4. Data capture: Attacker captures session replication payloads, application attributes, and any sensitive objects serialised across the cluster channel. This may include authenticated session tokens, user data, and application secrets held in session state.
  5. Data exploitation: Captured session data can be used for session hijacking, credential theft, or lateral movement depending on the content of replicated sessions.

CISA SSVC assessment: Exploitation = active; Automatable = yes; Technical impact = total (updated 2026-08-04 from "partial" to "total").

Exploitation context: CISA KEV entry confirms active exploitation as of 2026-08-04. No named threat actor attribution is present in the verified reference data; the NVD change history references a SOC Radar blog about a Chinese government campaign, but no MITRE ATT&CK actor profile is available in the verified data — treat any actor attribution as unconfirmed and single-sourced.

Additional context from related sources: ANSSI (CERTFR-2026-AVI-0876, 2026-07-15) and BSI (WID-SEC-2026-2310, WID-SEC-2026-1514) issued advisories covering multiple Tomcat vulnerabilities including security policy bypass and information disclosure, consistent with this CVE's impact profile. These are corroborating advisories but do not add CVE-specific technical detail beyond what NVD and GitHub Security Advisories provide.

4. Mitigation & containment

P1 — Within 24 hours (by 2026-08-07 per CISA KEV due date)

  1. Inventory and identify: Locate all Apache Tomcat deployments across the estate. Identify instances running versions 11.0.20, 10.1.53, or 9.0.116. Check for cluster configuration (<Cluster> element in server.xml) and EncryptInterceptor usage. - Command to identify Tomcat version: ./catalina.sh version or inspect RELEASE-NOTES file in the Tomcat installation directory. - Check server.xml for <Cluster> and EncryptInterceptor configuration.
  2. Patch to fixed versions: - Tomcat 11.0.20 → 11.0.21 - Tomcat 10.1.53 → 10.1.54 - Tomcat 9.0.116 → 9.0.117 - Download from: https://tomcat.apache.org/
  3. If patching is not immediately feasible: Isolate cluster traffic to a dedicated, non-routable VLAN or apply network-level encryption (e.g., IPsec, WireGuard tunnel) between cluster nodes as an interim control. This compensates for the EncryptInterceptor bypass by enforcing encryption at the network layer.

P2 — Within 72 hours

  1. Verify EncryptInterceptor functionality post-patch: After upgrading, confirm that the EncryptInterceptor is correctly enforcing encryption on cluster replication traffic. Use packet capture (tcpdump on the cluster replication port) to verify traffic is not in cleartext. - Default Tomcat cluster replication port: 45564 (TCP/UDP depending on configuration). - tcpdump -i <interface> port 45564 -A — confirm no readable plaintext in captured payloads.
  2. Review for prior exploitation: Check network logs and flow data for evidence of unusual traffic on cluster replication ports. If suspicious activity is identified, assume session data may have been compromised and rotate any credentials or tokens that may have been present in replicated sessions.
  3. Check Red Hat packaged Tomcat: NVD CPE configurations indicate affected packages on RHEL 8, 9, 10, and JBoss Web Server 7. If using Red Hat's Tomcat packages, apply Red Hat security advisories when available.

P3 — Within 7 days

  1. Update build pipelines and container images: Update all CI/CD pipelines, Docker base images, and infrastructure-as-code templates to pin Tomcat to fixed versions (11.0.21, 10.1.54, or 9.0.117).
  2. Implement regression testing: Add a post-deployment test that verifies EncryptInterceptor encryption is active on cluster traffic, to detect future regressions of this nature.

5. Indicators of compromise

No atomic indicators of compromise (IPs, domains, hashes, URLs) are available in the source material for this specific CVE.

Behavioural indicators

Behaviour Where to observe Confidence
Cleartext traffic on Tomcat cluster replication port (default 45564) Network IDS / packet capture on internal segments between Tomcat nodes High — direct consequence of the vulnerability
Unusual traffic capture / packet sniffing activity on internal VLANs carrying cluster traffic EDR / network monitoring on hypervisor or switch layer Medium — indicates potential exploitation attempt
Session token reuse from unexpected source IPs following cluster traffic interception Application logs, WAF logs, SIEM correlation Medium — downstream impact of captured session data

6. Detection

Insufficient indicators to author detection rules. The vulnerability is a network-level encryption bypass; no file artefacts, command-line strings, registry keys, or malware payloads are described in the source material. Detection should rely on network-level monitoring for cleartext traffic on Tomcat cluster replication ports as described in the behavioural indicators table above.

CVE assessment

1 referenced CVE — 1 actively exploited (CISA KEV)

CVE CVSS Exploited EPSS Summary
CVE-2026-34486 7.5 High ⚠ KEV 2026-08-04 43% Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of th…

7. Sources

  • NVD, CVE-2026-34486 Detail, https://nvd.nist.gov/vuln/detail/CVE-2026-34486, 2026-08-03
  • GitHub Security Advisories, GHSA-69r9-qgr7-g2wj — Apache Tomcat Missing Encryption of Sensitive Data vulnerability, https://github.com/advisories/GHSA-69r9-qgr7-g2wj, accessed 2026-08-05
  • CISA, Known Exploited Vulnerabilities Catalog — Apache Tomcat Missing Encryption of Sensitive Data Vulnerability (added 2026-08-04, due 2026-08-07), https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  • ANSSI France CERT, CERTFR-2026-AVI-0876 — Multiples vulnérabilités dans Apache Tomcat, https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0876/, 2026-07-15
  • BSI Germany, WID-SEC-2026-2310 — Apache Tomcat: Mehrere Schwachstellen, https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2310
  • BSI Germany, WID-SEC-2026-1514 — Apache Tomcat: Mehrere Schwachstellen (UPDATE), https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-1514

8. Adverse Trace position

CVE-2026-34486 is a HIGH-severity (CVSS 7.5) vulnerability with confirmed active exploitation in the wild (CISA KEV, added 2026-08-04). The regression nature of the flaw — a patch for CVE-2026-29146 breaking EncryptInterceptor — means organisations that applied the prior fix in good faith are now exposed. The CISA KEV due date of 2026-08-07 gives a 72-hour window from publication. For EMEA financial services, the primary risk is to internal Tomcat cluster deployments where session replication traffic carries sensitive data; internet-facing Tomcat instances without clustering are not directly affected by this specific CVE. We assess the client impact as elevated for any organisation running the three affected versions with clustering enabled. Adverse Trace will monitor for emergence of public exploit code, named actor attribution (currently unconfirmed and single-sourced via an indirect NVD reference), and any downstream Red Hat advisory publications. Clients should treat patching to 11.0.21 / 10.1.54 / 9.0.117 as immediate and verify EncryptInterceptor operation post-upgrade.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.

Post this to LinkedIn
Formatting is converted automatically — headings, bullets, a link back & hashtags. Paste straight in.
J
Jeff Davies