CVE-2026-55957 Apache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bind
Attackers can bypass authentication in Apache Tomcat when JNDIRealm is configured for GSSAPI binds, allowing unauthorized access without a correct password.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-55957?
CVE-2026-55957 is a high-severity authentication bypass vulnerability in Apache Tomcat, published on 29 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.4, from 10.1.0-M1 through 10.1.36, from 9.0.0.M1 through 9.0.100, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.
Users are recommended to upgrade to version 11.0.5, 10.1.37 or 9.0.101, which fixes the issue.
Weakness: CWE-304
Which versions are affected by CVE-2026-55957?
1 open source package ship an affected version, including tomcat. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
tomcat Bitnami | All versions | 9.0.101, 10.1.37, 11.0.5 |
Products include Apache Tomcat.
How do I fix CVE-2026-55957?
Upgrade tomcat to a fixed version for your release line: 9.0.101, 10.1.37 or 11.0.5.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-55957 being exploited?
There is no known exploitation of CVE-2026-55957 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Apache Tomcat
Sources
Also known as BIT-tomcat-2026-55957, CLSA-2026-1783522891, CLSA-2026-1783591320, CLSA-2026-1784541319, CLSA-2026-1785309072, CLSA-2026-1786880824 and 4 more.