External risk intelligence

Apache Tomcat JNDI Realm Authentication Bypass Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-101296

Apache Tomcat is a widely deployed web server and application server typically used to host public-facing web applications, APIs, and web services. While the specific vulnerability requires a JNDI realm configuration with a non-GSSAPI SASL mechanism, the underlying component is a common edge-facing technology, making it likely to be reachable from the internet in many deployments.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in Apache Tomcat, a widely used web server technology. This issue allows attackers to bypass authentication, potentially gaining unauthorized access to systems. The main concern at this time is to confirm whether our environment utilizes the specific configuration that could be affected.

Unauthenticated access is possible.
Confirm relevance to our specific configurations.
Understanding exposure is the immediate priority.

Attack Path

How an attacker could exploit the issue

An attacker could bypass authentication on a configured Apache Tomcat server by exploiting a missing security step during JNDI realm authentication. This allows them to gain unauthorized access without a valid password, potentially leading to further compromise of the application or server.

Accessible over the network.
Involves JNDI realm authentication.
Leads to unauthorized access.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in Apache Tomcat could allow unauthorized access when a specific JNDI realm configuration is used, bypassing password checks.

Unprotected Tomcat servers could be accessed.
Attackers could bypass authentication mechanisms.
Unauthorized access to hosted applications may occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and infrastructure teams are likely responsible for addressing this vulnerability in Apache Tomcat, especially if it's configured with a JNDI realm and a non-GSSAPI SASL authentication mechanism. The first practical step is to inventory all Tomcat instances, confirm which are exposed externally or host business-critical applications, and identify the accountable owner for each. This allows for a risk-based approach to planning remediation, potentially involving coordination with the vendor for upgrades or applying temporary mitigations.

Identify accountable application owners.
Verify external reachability and business criticality.
Plan vendor-supported upgrades or mitigations.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Apache Tomcat and how is it used?

Apache Tomcat is an open-source web server and servlet container that runs Java code. Developers use it to host web applications, APIs, and microservices. Because it manages connections and enforces security policies for these applications, it often serves as a primary entry point for users accessing business software over the internet.

What does CVE-2026-101296 mean for security?

This CVE describes a 'Missing Critical Step in Authentication' (CWE-304). Essentially, the software fails to properly verify user credentials during a specific login process. In this case, if the system is configured to use a JNDI realm with certain SASL authentication mechanisms, the server might incorrectly accept a connection even if the attacker does not provide a valid password.

How can an attacker trigger this authentication bypass?

An attacker initiates this by attempting to log in to an affected Tomcat server configured with a non-GSSAPI SASL mechanism. The vulnerability does not trigger if you are using other standard authentication methods like basic local user files or standard GSSAPI. It specifically requires that vulnerable JNDI realm configuration to be active and reachable for the authentication bypass to occur.

Is my Apache Tomcat server at risk?

Halo Surface Signal indicates that Apache Tomcat is frequently deployed as an edge-facing technology, making it likely to be reachable from the internet. If your server is exposed to the network and utilizes the specific JNDI realm configuration mentioned in the advisory, it could be reachable by unauthorized parties.

What are the first steps to secure my environment?

Begin by inventorying your Tomcat instances to determine which ones use a JNDI realm configuration. Once identified, check if they use non-GSSAPI SASL mechanisms. Prioritize these instances for an upgrade to the vendor-provided versions—11.0.27, 10.1.61, or 9.0.123—which contain the necessary code fixes to ensure proper password validation.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.