External risk intelligence

Apache Tomcat CLIENT_CERT Authentication Bypass Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-29145

Apache Tomcat is a widely deployed web server and application server commonly used to host public-facing web applications and APIs. As the vulnerability involves the authentication mechanism directly, it impacts services that are typically exposed to the internet to handle client requests, making the vulnerable surface public-facing by design in most standard deployments.

Authentication Bypass

Apache Tomcat

9.0.83 to before 9.0.11610.1.1 to before 10.1.5311.0.0 to before 11.0.2010.1.01.1.23 to before 1.3.72.0.0 to before 2.0.14

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in Apache Tomcat and Tomcat Native software, impacting how client certificates are handled during authentication. This could potentially allow unauthorized access if authentication checks do not function as expected. The primary concern is to confirm whether your environment utilizes this specific authentication method and is therefore exposed.

Authentication checks may not fail as intended.
Confirm if this specific authentication method is in use.
Understand potential exposure to unauthorized access.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending specially crafted requests to a vulnerable Apache Tomcat or Apache Tomcat Native instance. This bypasses the expected authentication failure when "soft fail" is disabled, allowing unauthorized access. The vulnerability can lead to the compromise of sensitive information and the integrity of the affected system.

No authentication is required to trigger.
Bypasses client certificate authentication.
Risk of unauthorized access and data compromise.

Live Threat

Current exploitation, exposure, and threat context

When CLIENT_CERT authentication is configured with soft fail disabled, specific scenarios could lead to authentication failures not occurring as expected in Apache Tomcat and Apache Tomcat Native. This could allow unauthorized access when client certificates are used for authentication.

Server authentication data.
Unauthorized access to server resources.
Compromise of sensitive server information.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-world ownership for this vulnerability likely resides with teams managing Apache Tomcat and Tomcat Native deployments, such as application owners or platform teams. The initial practical step involves identifying all instances of the affected software, assessing their exposure and criticality, locating the accountable owner, and then planning remediation based on the risk profile.

Identify affected technology instances.
Verify reachability and business criticality.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Apache Tomcat and how is it used?

Apache Tomcat is a widely deployed, open-source web server and Jakarta Servlet container. It acts as the engine that powers Java-based web applications, managing their execution and handling network traffic. Developers use it to host everything from internal tools to public-facing APIs, making it a foundational component for many enterprise software architectures.

What does CWE-287 mean for this CVE?

CWE-287 is the weakness class for Improper Authentication. In the context of CVE-2026-29145, it means the software fails to correctly verify the identity of a user or client. Specifically, the system should reject a connection when an invalid client certificate is presented, but it may allow the connection to proceed anyway, effectively bypassing the required authentication step.

How can an attacker trigger this vulnerability?

An attacker can trigger this flaw by sending a specially crafted request to an instance configured for CLIENT_CERT authentication where 'soft fail' is disabled. The bug does not trigger if the application does not use certificate-based authentication or if the software version is not within the identified range of affected releases.

Is my instance relevant to this vulnerability?

Your instance is relevant if it runs the affected Tomcat or Tomcat Native versions and uses client certificates for authentication. According to Halo Surface Signal, because this issue involves the core authentication mechanism of a web server frequently used for public-facing services, many deployments are inherently exposed to external network traffic.

When should I upgrade to resolve this?

You should plan an upgrade immediately if you verify that your services use CLIENT_CERT authentication. The practical first step is to inventory your environment to locate all running instances of the affected Tomcat and Tomcat Native versions. Once identified, apply the recommended updates to versions 11.0.20, 10.1.53, 9.0.116, 1.3.7, or 2.0.14 to close the authentication gap.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.