CVE-2026-15554 Undertow-core: undertow: authentication bypass via ajp ssl_cert/is_ssl forgery
An unauthenticated attacker can bypass CLIENT-CERT authentication in Undertow AJP by forging SSL attributes, requiring network access to port 8009.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-15554?
CVE-2026-15554 is a high-severity authentication bypass vulnerability in Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7, published on 11 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
the Undertow AJP listener honours forged ssl_cert and is_ssl AJP attributes without requiring any shared-secret authentication. This enables an unauthenticated attacker with direct TCP access to port 8009 to bypass CLIENT-CERT authentication by injecting a forged X.509 certificate via the AJP protocol.
Weakness: CWE-295
Which versions are affected by CVE-2026-15554?
How do I fix CVE-2026-15554?
Apply the vendor's patch.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-15554 being exploited?
There is no known exploitation of CVE-2026-15554 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-15554, GHSA-f478-cwfc-jqh3, UBUNTU-CVE-2026-15554.