CVE-2026-34486

CVE-2026-34486 Apache Tomcat Tribes 集群中 EncryptInterceptor 存在 fail-open 绕过漏洞，导致通过 Java 反序列化实现未授权远程代码执行（RCE）。 受影响版本：11.0.19+、10.1.53+、9.0.116+。 修复版本：11.0.21、10.1.54、9.0.117。 由 Bartlomiej Dmitruk striga.ai 发现并报告。 技术文章：https://striga.ai/research/tomcat-tribes-unauth-rce 需求 Docker Java 21 Python 3 使用...

CVE-2026-34486

CVE-2026-34486 — Apache Tomcat EncryptInterceptor RCE Apache Tomcat El módulo de comunicación del clúster Tribes no descarta los mensajes cuando falla el descifrado de EncryptInterceptor, lo que permite a atacantes no autenticados desencadenar Ejecución Remota de Código mediante deserialización d...

CVE-2026-34486---unauthenticated-RCE-via-Java-deserialization

CVE-2026-34486 Apache Tomcat Tribes 集群中 EncryptInterceptor 的 fail-open 绕过，导致通过 Java 反序列化实现未授权远程代码执行（RCE）。 受影响版本：11.0.19+、10.1.53+、9.0.116+。 修复版本：11.0.21、10.1.54、9.0.117。 发现并报告者：Bartlomiej Dmitruk（striga.ai）。 技术分析：https://striga.ai/research/tomcat-tribes-unauth-rce 环境要求 Docker Java 21 Python 3 用法...

Apache Tomcat Tribes EncryptInterceptor Bypass - Remote Code Execution

Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. id: CVE-2026-34486 info: name: Apache Tomcat Tribes EncryptInterceptor Bypass - Remote...

CVE-2026-66713

A flaw was found in Apache Axis2/Java, specifically within its Tribes-based clustering component. When this clustering feature is enabled on Apache Tomcat, an attacker can exploit a vulnerability related to the deserialization of untrusted data. This allows an unauthenticated remote attacker, wit...

CVE-2026-66713

Deserialization of Untrusted Data CWE-502 in the Tribes-based clustering component in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat only when Tribes clustering is enabled, which is off by default allows an unauthenticated remote attacker with network access to the...

CVE-2026-66713

CVE-2026-66713 affects Apache Axis2/Java up to version 2.0.0 on Tomcat, where the Tribes-based clustering feature (off by default) allows an unauthenticated remote attacker to execute arbitrary code via a crafted serialized Java object delivered to the cluster port. The vulnerability occurs durin...

CVE-2026-66713 Apache Axis2/Java: deserialization of untrusted Data

Deserialization of Untrusted Data CWE-502 in the Tribes-based clustering component in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat only when Tribes clustering is enabled, which is off by default allows an unauthenticated remote attacker with network access to the...

CVE-2026-66713

Deserialization of Untrusted Data CWE-502 in the Tribes-based clustering component in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat only when Tribes clustering is enabled, which is off by default allows an unauthenticated remote attacker with network access to the...

EUVD-2026-49849

Deserialization of Untrusted Data CWE-502 in the Tribes-based clustering component in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat only when Tribes clustering is enabled, which is off by default allows an unauthenticated remote attacker with network access to the...

CVE-2026-66713 Apache Axis2/Java: deserialization of untrusted Data

Deserialization of Untrusted Data CWE-502 in the Tribes-based clustering component in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat only when Tribes clustering is enabled, which is off by default allows an unauthenticated remote attacker with network access to the...

PT-2026-65496

Name of the Vulnerable Software and Affected Versions Apache Axis2/Java versions prior to 2.0.1 Description An issue exists in the Tribes-based clustering component when running on Apache Tomcat. When Tribes clustering is enabled, an unauthenticated remote attacker with network access to the...

Exploit for Reliance on Untrusted Inputs in a Security Decision in Apache Tomcat

Lab Description This lab focuses on CVE-2026-34486, a hig...

CVE-2026-55955

A flaw was found in Apache Tomcat. An improper authentication vulnerability in the EncryptionInterceptor component allows a remote attacker to perform a replay attack. This could lead to unauthorized access or manipulation of data within the cluster component. Mitigation This vulnerability only...

Exploit for Missing Encryption of Sensitive Data in Apache Tomcat

CVE-2026-34486 EncryptInterceptor fail-open bypass in Apache...

Exploit for Missing Encryption of Sensitive Data in Apache Tomcat

CVE-2026-34486-Tribes Apache Tomcat Tribes cluster communicat...

Exploit for Missing Encryption of Sensitive Data in Apache Tomcat

CVE-2026-34486 — Apache Tomcat EncryptInterceptor RCE Apa...

Insertion of Sensitive Information into Log File

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File in the form of Kubernetes bearer tokens being printed in logs of the cloud membership for clustering module. Remediation Upgrade org.apache.tomcat:tomcat-tribes to version 9.0.117, 10.1.5...

Missing Encryption of Sensitive Data

Overview Affected versions of this package are vulnerable to Missing Encryption of Sensitive Data in the EncryptInterceptor's messageReceived method. An attacker can gain unauthorized access to sensitive data by bypassing EncryptInterceptor to intercept unencrypted communications. Note: This is d...

Use of a Broken or Risky Cryptographic Algorithm

Overview Affected versions of this package are vulnerable to Use of a Broken or Risky Cryptographic Algorithm in the EncryptInterceptor class, which defaults to CBC mode. An attacker can obtain sensitive information via padding oracle. Remediation Upgrade org.apache.tomcat:tomcat-tribes to versio...