CVE-2026-34486

CVE-2026-34486 EncryptInterceptor fail-open bypass in Apache Tomcat Tribes clustering leading to unauthenticated RCE via Java deserialization. Affected: 11.0.19+, 10.1.53+, 9.0.116+. Fixed in: 11.0.21, 10.1.54, 9.0.117. Found and reported by Bartlomiej Dmitruk striga.ai. Writeup:...

io.antmedia:ant-media-server (>=2.8.0, <=3.0.3), io.github.microsphere-projects:microsphere-spring-cloud-gateway (0.2.0) +18 more potentially affected by CVE-2026-55955 via org.apache.tomcat:tomcat-tribes (>=10.1.0-m1, <=10.1.55)

org.apache.tomcat:tomcat-tribes MAVEN version =10.1.0-m1, =2.8.0, =0.2.2, =10.1.0-m1, =10.1.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.1.5 and more Source cves: CVE-2026-55955 Source advisory: MEND:CVE-2026-559...

Exploit for Missing Encryption of Sensitive Data in Apache Tomcat

CVE-2026-34486-Tribes Apache Tomcat Tribes cluster communicat...

Exploit for Missing Encryption of Sensitive Data in Apache Tomcat

CVE-2026-34486 — Apache Tomcat EncryptInterceptor RCE Apa...

io.antmedia:ant-media-server (3.0.1), org.apache.tomcat:tomcat-catalina-ha (10.1.53) +1 more potentially affected by CVE-2026-34486 via org.apache.tomcat:tomcat-tribes (10.1.53)

org.apache.tomcat:tomcat-tribes MAVEN version 10.1.53 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-tribes and may be impacted: - io.antmedia:ant-media-server 3.0.1 - org.apache.tomcat:tomcat-catalina-ha 10.1.53 -...

com.exactpro.sf:sailfish-frontend (>=3.2.1036, <=3.4.260), cv.igrp:igrp-core (>=1.7.2.230613, <=1.8.3.240913) +33 more potentially affected by CVE-2026-34487 via org.apache.tomcat:tomcat-tribes (>=9.0.13, <=9.0.116)

org.apache.tomcat:tomcat-tribes MAVEN version =9.0.13, =3.2.1036, =1.7.2.230613, =1.7.2.230622, =0.1.2, =9.0.13, =9.0.13, =8.0.1, =8.0.5, =8.0.5, =8.0.5, =8.0.0-m3, =8.0.16 and more Source cves: CVE-2026-34487 Source advisory: GHSA-X4M4-345F-5H5G...

io.antmedia:ant-media-server (>=2.8.0, <=3.0.1), io.github.microsphere-projects:microsphere-spring-cloud-gateway (0.2.0) +18 more potentially affected by CVE-2026-34487 via org.apache.tomcat:tomcat-tribes (>=10.1.0-m1, <=10.1.53)

org.apache.tomcat:tomcat-tribes MAVEN version =10.1.0-m1, =2.8.0, =0.2.2, =10.1.0-m1, =10.1.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.1.4 and more Source cves: CVE-2026-34487 Source advisory: GHSA-X4M4-345F-5H...

org.apache.tomcat:tomcat-catalina-ha (11.0.20), org.apache.tomcat:tomcat-storeconfig (11.0.20) +1 more potentially affected by CVE-2026-34486 via org.apache.tomcat:tomcat-tribes (11.0.20)

org.apache.tomcat:tomcat-tribes MAVEN version 11.0.20 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-tribes and may be impacted: - org.apache.tomcat:tomcat-catalina-ha 11.0.20 - org.apache.tomcat:tomcat-storeconfig 11.0.20 -...

org.apache.axis2:axis2-clustering (2.0.0), org.apache.axis2:axis2-webapp (2.0.0) +5 more potentially affected by CVE-2026-34487 via org.apache.tomcat:tomcat-tribes (>=11.0.0-m1, <=11.0.20)

org.apache.tomcat:tomcat-tribes MAVEN version =11.0.0-m1, =11.0.0-m1, =11.0.0-m1, =7.3.0-rc1, =8.0.0-rc3 - org.ow2.petals.axis2:axis2-clustering 2.0.0-petals-0 - org.ow2.petals.axis2:axis2-webapp 2.0.0-petals-0 Source cves: CVE-2026-34487 Source advisory: GHSA-X4M4-345F-5H5G...

org.apache.axis2:axis2-clustering (2.0.0), org.apache.axis2:axis2-webapp (2.0.0) +5 more potentially affected by CVE-2026-34487 via org.apache.tomcat:tomcat-tribes (>=11.0.0-m1, <=11.0.20)

org.apache.tomcat:tomcat-tribes MAVEN version =11.0.0-m1, =11.0.0-m1, =11.0.0-m1, =7.3.0-rc1, =8.0.0-rc3 - org.ow2.petals.axis2:axis2-clustering 2.0.0-petals-0 - org.ow2.petals.axis2:axis2-webapp 2.0.0-petals-0 Source cves: CVE-2026-34487 Source advisory: OSV:GHSA-X4M4-345F-5H5G...

Insertion of Sensitive Information into Log File

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File in the form of Kubernetes bearer tokens being printed in logs of the cloud membership for clustering module. Remediation Upgrade org.apache.tomcat:tomcat-tribes to version 9.0.117, 10.1.5...

org.apache.axis2:axis2-clustering (2.0.0), org.apache.axis2:axis2-webapp (2.0.0) +5 more potentially affected by CVE-2026-34487 via org.apache.tomcat:tomcat-tribes (>=11.0.0-m1, <=11.0.20)

org.apache.tomcat:tomcat-tribes MAVEN version =11.0.0-m1, =11.0.0-m1, =11.0.0-m1, =7.3.0-rc1, =8.0.0-rc3 - org.ow2.petals.axis2:axis2-clustering 2.0.0-petals-0 - org.ow2.petals.axis2:axis2-webapp 2.0.0-petals-0 Source cves: CVE-2026-34487 Source advisory: SNYK:JAVA-ORGAPACHETOMCAT-15989969...

io.antmedia:ant-media-server (>=2.8.0, <=3.0.1), io.github.microsphere-projects:microsphere-spring-cloud-gateway (0.2.0) +18 more potentially affected by CVE-2026-34487 via org.apache.tomcat:tomcat-tribes (>=10.1.0-m1, <=10.1.53)

org.apache.tomcat:tomcat-tribes MAVEN version =10.1.0-m1, =2.8.0, =0.2.2, =10.1.0-m1, =10.1.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.1.4 and more Source cves: CVE-2026-34487 Source advisory:...

org.apache.tomcat:tomcat-catalina-ha (>=7.0.100, <=7.0.109) potentially affected by CVE-2026-29146 via org.apache.tomcat:tomcat-tribes (>=7.0.100, <=7.0.109)

org.apache.tomcat:tomcat-tribes MAVEN version =7.0.100, =7.0.100, =7.0.109 Source cves: CVE-2026-29146 Source advisory: GHSA-H468-7PVH-8VR8...

org.apache.tomcat:tomcat-catalina-ha (>=10.1.50, <=10.1.52), org.apache.tomcat:tomcat-storeconfig (>=10.1.50, <=10.1.52) +11 more potentially affected by CVE-2026-29146 via org.apache.tomcat:tomcat-tribes (>=10.1.50, <=10.1.52)

org.apache.tomcat:tomcat-tribes MAVEN version =10.1.50, =10.1.50, =10.1.50, =10.1.52 - org.apache.tomee.bom:tomee-webprofile 10.1.4 - org.apache.tomee.maven:tomee-embedded-maven-plugin 10.1.4 - org.apache.tomee:arquillian-tomee-config-tests 10.1.4 - org.apache.tomee:arquillian-tomee-embedded 10.1...

org.apache.axis2:axis2-clustering (2.0.0), org.apache.axis2:axis2-webapp (2.0.0) +5 more potentially affected by CVE-2026-29146 via org.apache.tomcat:tomcat-tribes (>=11.0.0-m1, <=11.0.18)

org.apache.tomcat:tomcat-tribes MAVEN version =11.0.0-m1, =11.0.0-m1, =11.0.0-m1, =7.3.0-rc1, =8.0.0-rc2 - org.ow2.petals.axis2:axis2-clustering 2.0.0-petals-0 - org.ow2.petals.axis2:axis2-webapp 2.0.0-petals-0 Source cves: CVE-2026-29146 Source advisory: GHSA-H468-7PVH-8VR8...

org.apache.tomcat:tomcat-catalina-ha (>=7.0.100, <=7.0.109) potentially affected by CVE-2026-29146 via org.apache.tomcat:tomcat-tribes (>=7.0.100, <=7.0.109)

org.apache.tomcat:tomcat-tribes MAVEN version =7.0.100, =7.0.100, =7.0.109 Source cves: CVE-2026-29146 Source advisory: OSV:GHSA-H468-7PVH-8VR8...

io.antmedia:ant-media-server (>=2.8.0, <=3.0.1), io.github.microsphere-projects:microsphere-spring-cloud-gateway (0.2.0) +18 more potentially affected by CVE-2026-34487 via org.apache.tomcat:tomcat-tribes (>=10.1.0-m1, <=10.1.53)

org.apache.tomcat:tomcat-tribes MAVEN version =10.1.0-m1, =2.8.0, =0.2.2, =10.1.0-m1, =10.1.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.1.4 and more Source cves: CVE-2026-34487 Source advisory: MEND:CVE-2026-344...

org.apache.axis2:axis2-clustering (2.0.0), org.apache.axis2:axis2-webapp (2.0.0) +5 more potentially affected by CVE-2026-34487 via org.apache.tomcat:tomcat-tribes (>=11.0.0-m1, <=11.0.20)

org.apache.tomcat:tomcat-tribes MAVEN version =11.0.0-m1, =11.0.0-m1, =11.0.0-m1, =7.3.0-rc1, =8.0.0-rc3 - org.ow2.petals.axis2:axis2-clustering 2.0.0-petals-0 - org.ow2.petals.axis2:axis2-webapp 2.0.0-petals-0 Source cves: CVE-2026-34487 Source advisory: MEND:CVE-2026-34487...

org.apache.tomcat:tomcat-catalina-ha (9.0.116), org.apache.tomcat:tomcat-storeconfig (9.0.116) potentially affected by CVE-2026-34486 via org.apache.tomcat:tomcat-tribes (9.0.116)

org.apache.tomcat:tomcat-tribes MAVEN version 9.0.116 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-tribes and may be impacted: - org.apache.tomcat:tomcat-catalina-ha 9.0.116 - org.apache.tomcat:tomcat-storeconfig 9.0.116...