CVE-2026-66422 Apache Tomcat: Servlet role references can bypass declarative role constraints

🗓️ 25 Aug 2026 21:55:16Reported by apacheType

Improper authorization in Apache Tomcat: security-role-ref bypasses declarative role constraints.

Reporter	Title	Published	Views	Family All 83
IBM Security Bulletins	Security Bulletin: IBM ApplinX is vulnerable to multiple issues like improper Access control, Authentication Bypass, Improper Authorization and more due to the use of Apache-Tomcat .	22 Sep 202612:55	–	ibm
IBM Security Bulletins	Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.	5 Oct 202608:14	–	ibm
IBM Security Bulletins	Security Bulletin: DEV-EXT - tomcat-embed-core-10.1.57.jar (Publicly disclosed vulnerability found by Scanner)	17 Sep 202620:18	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Quantum Safe Explorer is affected by multiple vulnerabilities	28 Sep 202606:43	–	ibm
AstraLinux	Astra Linux – Vulnerability in Tomcat9	14 Sep 202612:01	–	astralinux
Circl	CVE-2026-66422	26 Aug 202601:06	–	circl
CVE	CVE-2026-66422	25 Aug 202621:55	–	cve
Debian CVE	CVE-2026-66422	25 Aug 202621:55	–	debiancve
EUVD	EUVD-2026-66131	26 Aug 202600:30	–	euvd
F5 Networks	K000163239: Multiple Apache Tomcat vulnerabilities	8 Sep 202607:18	–	f5

[
  {
    "vendor": "Apache Software Foundation",
    "product": "Apache Tomcat",
    "versions": [
      {
        "status": "affected",
        "version": "11.0.0-M1",
        "lessThanOrEqual": "11.0.24",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "10.1.0-M1",
        "lessThanOrEqual": "10.1.57",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "9.0.25",
        "lessThanOrEqual": "9.0.120",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "8.5.46",
        "lessThanOrEqual": "8.5.100",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "7.0.97",
        "lessThanOrEqual": "7.0.109",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "7.0.97",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
lists	www.lists.apache.org/thread/j5plylz1b2vhqvbkqn7k58nygxhcpk73

25 Aug 2026 21:55Current

CVSS 3.18.1

EPSS0.00431

SSVC

CWE-285