Update Tomcat now to stop password bypass and data leaks

Users of Apache Tomcat web servers face immediate risks if they have not applied the latest security updates. The software vendor has released patches for eight vulnerabilities that could allow attackers to bypass password checks or expose data between different users. These issues affect specific components and configurations, meaning not every installation is equally vulnerable, but the potential for account compromise and data leakage remains significant for those running older versions.

Which versions need updating?

Administrators must ensure their systems are running Tomcat 11.0.27, 10.1.61, or 9.0.123, depending on their current branch. The fixes address flaws spanning multiple release lines, including versions as early as 11.0.0-M1 and 9.0.0.M1. According to Cyber Security News, the vendor disclosed these vulnerabilities on October 20, 2026, after making the corrected code available. Users of any version prior to these specific releases should check their software status immediately to determine if they are exposed to the authentication and data handling defects.

What kind of data is at risk?

The most serious flaws involve authentication bypass and the mixing of user data. CVE-2026-101296 allows attackers to log in without correct passwords when JNDIRealm uses non-GSSAPI SASL mechanisms. Additionally, CVE-2026-101356 and CVE-2026-103119 can cause responses from one user to leak into another’s session during HTTP/2 or AJP processing. GBHackers notes that these errors create paths for cross-user disclosure, potentially exposing sensitive information to unauthorised parties who share the same server connection or request pipeline.

Are all installations vulnerable?

No, the impact depends on how the server is configured. The authentication bypass only affects systems using specific JNDIRealm settings, not every login method. Similarly, the data leakage flaws require HTTP/2 or AJP connectors to be active and processing specific types of requests. Apache rates three of the eight flaws as Important and five as Low. This distinction highlights that while the authentication issue is severe, other problems like TLS 1.3 connection failures or incomplete cleanup of HTTP/2 trailers pose lower immediate risks to data confidentiality.

What comes next for users?

Organisations must audit their Tomcat deployments to identify which components are active. Administrators should verify whether JNDIRealm, AJP connectors, or HTTP/2 processing are enabled, as these are the primary vectors for the high-severity flaws. Once the configuration is understood, teams should apply the relevant patch from the supported branches. Ignoring these updates leaves systems open to attacks that exploit the missing validation steps and object recycling errors described in the vendor’s advisory.

What affected people can do

Teams usually begin by inventorying all servers running Tomcat to identify outdated versions. Check whether JNDIRealm or AJP connectors are enabled, as these increase exposure. Monitor logs for unusual authentication attempts or mixed response data, which may indicate exploitation. Be wary of follow-up scams claiming to offer emergency fixes; always download updates directly from the official Apache website. Verify that your security tools are configured to detect unauthorised access patterns associated with these specific flaws.

Background: Data leaks

Data leaks occur when sensitive information escapes its intended boundary. This happens through accidental sharing, poor system configuration, or malicious theft. You can prevent leaks by enforcing strict access controls, monitoring data flows, and ensuring employees understand how to handle sensitive files securely.

Read the full guide: What is Data Leaks: How Information Escapes and How to Stop It

What to do and how to stay safe: Apache Tomcat

• Verify your Tomcat version against the fixed releases listed in the advisory.
• Check if JNDIRealm or AJP connectors are enabled in your configuration files.
• Apply the latest patch from the official Apache repository immediately.
• Monitor server logs for signs of unauthorised access or data mixing.

Step-by-step guide: Is It Safe to Use Password Managers? The Real Risks and Rewards

General security guidance from the DarkWeb Dispatch newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Does CVE-2026-101296 affect all Tomcat users?

No, it only affects installations using JNDIRealm with non-GSSAPI SASL authentication mechanisms.

What is the severity of the authentication bypass?

Apache rates the authentication bypass flaw as Important, along with two other vulnerabilities.

Are there fixes for the data leakage issues?

Yes, fixes are included in Tomcat 11.0.27, 10.1.61, and 9.0.123.