CVE-2026-55955: Apache Tomcat Cluster Replay Attack Vulnerability (CVSS 6.5)

Technical summary

CVE-2026-55955 is an improper authentication vulnerability in Apache Tomcat's EncryptionInterceptor component within the clustering subsystem. The vulnerability enables replay attacks where an attacker can intercept encrypted cluster communication and retransmit captured messages to authenticate without proper credentials. This occurs because the interceptor does not implement sufficient replay protection mechanisms such as nonce validation or timestamp verification. The vulnerability is classified under CWE-287 (Improper Authentication) and carries a CVSS 3.1 score of 6.5 (Medium severity) with a network attack vector requiring no privileges or user interaction.

Business impact

Organizations operating Tomcat in clustered deployments face confidentiality and integrity risks. An attacker on the network could replay captured cluster messages to impersonate legitimate cluster nodes, potentially reading sensitive data exchanged between servers or modifying cluster state. This is most concerning for environments where Tomcat clusters handle sensitive workloads or where cluster nodes are exposed to untrusted networks. The attack requires network access but no authentication credentials, making it a concern for perimeter security and internal network segmentation. Availability is not directly impacted.

Affected systems

The vulnerability affects Apache Tomcat versions: 11.0.0-M1 through 11.0.22; 10.1.0-M1 through 10.1.55; 9.0.13 through 9.0.18; 8.5.38 through 8.5.100; and 7.0.100 through 7.0.109. Standalone Tomcat installations or clusters not using the EncryptionInterceptor are not affected. Single-node deployments with clustering disabled are not at risk from this specific vulnerability. Verify your version against the vendor advisory to confirm exposure.

Exploitability

This vulnerability requires network access to the cluster communication channel, which typically operates on internal networks. The attack does not require authentication credentials, elevated privileges, or user interaction. An attacker must be positioned to capture cluster traffic (man-in-the-middle or network access to the cluster subnet) and replay messages, but exploitation is straightforward once that access is obtained. The vulnerability has not been added to CISA's Known Exploited Vulnerabilities catalog as of the latest update, but the low barrier to exploitation once cluster access is gained warrants prompt attention.

Remediation

Upgrade affected Tomcat installations to patched versions: 11.0.23 or later, 10.1.56 or later, or 9.0.119 or later. Versions 7.0.x and 8.5.x do not have patch versions listed; verify current support status with Apache before planning upgrades to these older branches. If upgrades cannot be immediately deployed, restrict network access to cluster communication ports and implement network segmentation to limit attacker positioning capability.

Patch guidance

Apache recommends upgrading to Tomcat 11.0.23, 10.1.56, or 9.0.119 depending on your release branch. Plan upgrades during maintenance windows; clustering remains available during the patched version deployment. Verify patch application by confirming version number post-restart. For organizations on Tomcat 8.5 or 7.0, consult the Apache Tomcat security documentation to determine long-term support status and available alternatives, as patched versions for these branches were not identified in the advisory.

Detection guidance

Monitor cluster communication logs for anomalous patterns such as repeated messages with identical content or timestamps, which may indicate replay attempts. Network-based detection should focus on the cluster interconnect ports (typically configured in cluster manager settings) for suspicious patterns of retransmitted frames. Host-based detection is limited; focus on access logs for unexpected cluster node initialization or state changes that correlate with network anomalies. Implement network segmentation to isolate cluster traffic and reduce the attack surface.

Why prioritize this

This vulnerability merits prompt attention because it affects multiple active versions of Tomcat and targets the cluster communication layer with no authentication requirement. While the CVSS score is Medium (6.5) and exploitability requires network access, any organization using Tomcat clustering should treat this as a moderate-to-high priority in their patch cycle. The vulnerability does not appear in active exploitation campaigns (KEV status: not listed) but should be patched before moving infrastructure to untrusted networks or increasing cluster exposure.

Risk score, explained

The CVSS 3.1 score of 6.5 (Medium) reflects a network-accessible vulnerability with low complexity and no authentication barrier, offset by limited impact scope (confidentiality and integrity of cluster data only, no availability impact). In environments where cluster nodes are exposed to hostile networks or where inter-cluster traffic traverses untrusted infrastructure, the practical risk may be higher than the base score suggests. Organizations with air-gapped or tightly segmented cluster networks may view this as lower priority.

Frequently asked questions