CVE-2026-55956: Apache Tomcat Authorization Bypass via Method-Based Access Control Bypass

Technical summary

The vulnerability stems from improper authorization logic in Apache Tomcat's default servlet implementation. Security constraints defined in the deployment descriptor to restrict specific HTTP methods (GET, POST, etc.) or method omissions are not correctly enforced. An attacker can craft requests using HTTP methods that should be blocked by the constraint rules, effectively bypassing the intended access control policy. The root cause is a failure in the constraint evaluation logic when applied to the default servlet, allowing method-based restrictions to be ignored during request authorization checks.

Business impact

Organizations relying on Tomcat's method-based access controls to protect sensitive resources face a direct risk of unauthorized access. Attackers could exploit this to read sensitive data, modify application state, or perform administrative actions depending on the affected resource and HTTP methods involved. The risk is elevated in multi-tenant or publicly exposed Tomcat instances where method restrictions form part of the security perimeter. Patching delays increase exposure window for exploitation.

Affected systems

Apache Tomcat versions 7.0.0–7.0.109, 8.5.0–8.5.100, 9.0.0.M1–9.0.118, 10.1.0-M1–10.1.55, and 11.0.0-M1–11.0.22 are affected. Tomcat 7.x and 8.5.x are in extended support or maintenance phases. Organizations running any of these versions should assume they are vulnerable unless patched. End-of-life versions may not receive updates and should be prioritized for migration planning.

Exploitability

Exploitation requires only network access and the ability to craft HTTP requests—no authentication, user interaction, or complex attack chain is needed. The vulnerability can be triggered remotely with standard HTTP tooling. However, actual impact depends on what resources are protected by method-based constraints in a given deployment. Exploitation is relatively straightforward once a vulnerable constraint configuration is identified, making this a practical concern for attackers scanning for misconfigured Tomcat instances.

Remediation

Upgrade to Apache Tomcat 9.0.119, 10.1.56, or 11.0.23 or later. For organizations unable to patch immediately, implement network-level controls such as WAF rules that validate HTTP method restrictions before requests reach Tomcat, or restrict access to the Tomcat application through IP whitelisting. Review and test all security constraints in your deployment descriptor to ensure they align with your intended access control policy post-patch.

Patch guidance

Apply patches at the earliest opportunity given the ease of exploitation. Tomcat 9.x users should upgrade to 9.0.119; Tomcat 10.1.x users should upgrade to 10.1.56; Tomcat 11.x users should upgrade to 11.0.23. For Tomcat 7.x and 8.5.x, verify the specific patched versions against the vendor advisory, as these older branches may have different release schedules. Test patches in a staging environment before production deployment, particularly if you rely on method-based access controls.

Detection guidance

Monitor HTTP access logs for unusual patterns where requests using less common HTTP methods (PUT, DELETE, OPTIONS, TRACE) succeed against resources that should reject them based on security constraints. Search for 200/20x responses to such requests on protected paths. Additionally, review your security constraint configurations in web.xml to identify which resources depend on method-based restrictions. Tomcat debug logging can be enabled to capture constraint evaluation details during request processing.

Why prioritize this

Although the CVSS score is 6.5 (Medium), the practical exploitability is high due to no authentication requirement and trivial attack mechanics. Environments with public-facing Tomcat instances or those storing sensitive data should prioritize patches. Method-based access controls are a common security pattern, increasing the likelihood that some deployments rely on this mechanism. The broad version range affected (7.x through 11.x) means most organizations running Tomcat likely need to assess their exposure.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects low impact (no confidentiality or integrity loss at the system level, no availability impact) and low attack complexity, but the practical risk is moderated by the fact that impact depends on what constraints exist in a specific deployment. However, the low barrier to exploitation and network-accessible attack vector elevate real-world concern. Organizations with strict method-based access control policies should treat this as higher priority than the base score suggests.

Frequently asked questions