Alerts
Missing Encryption Vulnerability in Apache Tomcat
7 August 2026
Attackers can exploit a missing encryption vulnerability in Apache Tomcat to bypass the EncryptInterceptor, potentially exposing sensitive data transmitted between cluster nodes. Patch immediately.
Background
Apache has released security updates to address a missing encryption vulnerability (CVE-2026-34486) affecting Apache Tomcat. The vulnerability was introduced by a previous fix for CVE-2026-29146 which could allow the EncryptInterceptor to be bypassed.
The vulnerability has a Common Vulnerability Scoring System (CVSS v3.1) score of 7.5 out of 10.
Impact
Successful exploitation of this vulnerability could allow an attacker to bypass the EncryptInterceptor, resulting in sensitive data being transmitted without encryption between affected Apache Tomcat cluster nodes.
Known Exploitation
This vulnerability is reportedly being actively exploited.
Affected Products
The vulnerability affects the following products:
Apache Tomcat 11.0.20
Apache Tomcat 10.1.53
Apache Tomcat 9.0.116
Recommendations
Users and administrators of affected products are advised to update to the latest versions immediately.
Administrators using Apache Tomcat clustering with the EncryptInterceptor should update affected installations to the fixed releases and review systems for signs of unauthorised access or exposure of sensitive data.
References
https://tomcat.apache.org/security-11.html
https://tomcat.apache.org/security-10.html