PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-34486 Apache Software Foundation CVE debrief

A regression vulnerability in Apache Tomcat's EncryptInterceptor allows bypass of encryption protections for sensitive data in transit. The flaw was introduced by the fix for CVE-2026-29146, creating a missing encryption condition (CWE-311) that exposes confidential data to network adversaries. Affected versions are 9.0.116, 10.1.53, and 11.0.20. The vulnerability carries a HIGH severity CVSS 7.5 score with network attack vector, low complexity, and no required privileges or user interaction. Apache released patched versions 9.0.117, 10.1.54, and 11.0.21 on April 9, 2026. The CVE record was subsequently modified on May 26, 2026. No known exploitation in ransomware campaigns has been documented.

Vendor
Apache Software Foundation
Product
Apache Tomcat
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-09
Original CVE updated
2026-05-26
Advisory published
2026-04-09
Advisory updated
2026-05-26

Who should care

Organizations running Apache Tomcat in clustered configurations with EncryptInterceptor enabled, particularly those with cluster replication traffic traversing untrusted networks. Security teams responsible for Java application server infrastructure and compliance officers concerned with data-in-transit encryption requirements.

Technical summary

Apache Tomcat's EncryptInterceptor, which provides encryption for cluster replication traffic, can be bypassed due to a flaw introduced by the fix for CVE-2026-29146. This creates a missing encryption condition (CWE-311) where sensitive data transmitted between Tomcat cluster nodes may be sent without cryptographic protection. The vulnerability affects specific point releases: 9.0.116, 10.1.53, and 11.0.20. Attackers with network access to cluster communication channels can intercept confidential data without authentication or user interaction. The vulnerability does not affect data integrity or availability. Resolution requires upgrading to the subsequent patch releases: 9.0.117, 10.1.54, or 11.0.21.

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade Apache Tomcat to version 9.0.117, 10.1.54, or 11.0.21 or later
  • Verify EncryptInterceptor configuration is active in cluster deployments
  • Review Tomcat cluster communication for sensitive data exposure
  • Monitor for unauthorized access to cluster replication traffic
  • Apply patches immediately for internet-facing Tomcat cluster instances

Evidence notes

The vulnerability description explicitly states this is a regression from CVE-2026-29146 fix allowing EncryptInterceptor bypass. CPE criteria confirm exact affected versions without range ambiguity. CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N indicates confidentiality impact only.

Official resources

Apache disclosed this vulnerability via their security mailing list on April 9, 2026, identifying it as a regression from a prior security fix. The issue was later updated in NVD on May 26, 2026.