CLEANSTART-2026-IS05941 CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native

🗓️ 23 Apr 2026 00:39:55Reported by GoogleType

osv🔗 osv.dev👁 35 Views

Vulnerabilities affect thingsboard; CLIENT_CERT auth may not fail when soft fail is off in Tomcat.

Reporter	Title	Published	Views	Family All 4606
OSV	CGA-4MJQ-F558-WWFR	27 Mar 202601:41	–	osv
OSV	CGA-4P25-2V45-RPGC	30 Oct 202519:11	–	osv
OSV	CGA-4P2Q-7429-FGV5	11 Apr 202614:06	–	osv
OSV	CGA-4P37-G28R-658J	17 Apr 202611:23	–	osv
OSV	CGA-4P59-2JMG-MRH9	27 Mar 202600:20	–	osv
OSV	CGA-4P6M-X6MQ-VHG4	30 Oct 202522:26	–	osv
OSV	CGA-4P9V-4F5Q-246M	17 Apr 202613:24	–	osv
OSV	CGA-4PF6-MCPQ-C5Q9	5 Aug 202619:21	–	osv
OSV	CGA-4PFP-HXJJ-GFMR	17 Apr 202611:27	–	osv
OSV	CGA-4PGG-8W3M-7C69	17 Apr 202612:56	–	osv

Source	Link
github	www.github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-IS05941.json
osv	www.osv.dev/vulnerability/CVE-2025-41254
osv	www.osv.dev/vulnerability/CVE-2025-66614
osv	www.osv.dev/vulnerability/CVE-2025-7962
osv	www.osv.dev/vulnerability/CVE-2025-8916
osv	www.osv.dev/vulnerability/CVE-2026-1225
osv	www.osv.dev/vulnerability/CVE-2026-22735
osv	www.osv.dev/vulnerability/CVE-2026-22737
osv	www.osv.dev/vulnerability/CVE-2026-24281
osv	www.osv.dev/vulnerability/CVE-2026-24308

18 Sep 2026 12:17Current

5.7Medium risk

Vulners AI Score5.7

CVSS 3.19.8

EPSS0.01177

thingsboard vulnerabilities client certificate authentication soft fail off apache tomcat apache tomcat native