CVE-2026-55957: Apache Tomcat GSSAPI LDAP Authentication Bypass (CVSS 7.3)

Technical summary

The vulnerability resides in Tomcat's JNDIRealm authentication handler when configured to use GSSAPI for LDAP bind operations. A critical step in the GSSAPI authentication sequence is missing, allowing an attacker to complete the authentication handshake without supplying correct credentials. This affects the authentication logic directly, not a downstream permission or access control layer. The issue is classified under CWE-304 (Missing Critical Step in Authentication), indicating a flaw in the core authentication mechanism rather than a cryptographic weakness or injection vulnerability.

Business impact

Successful exploitation grants unauthorized access to Tomcat-hosted applications without credential validation. An attacker can impersonate any user if GSSAPI/LDAP authentication is in use. This leads to data breach, unauthorized transactions, lateral movement within the application, and potential compliance violations (PCI-DSS, HIPAA, SOC 2) that mandate strong authentication. The ease of exploitation and network-accessible nature means threat actors can target internet-facing Tomcat instances at scale.

Affected systems

Apache Tomcat versions 7.0.0–7.0.109, 8.5.0–8.5.100, 9.0.0.M1–9.0.100, 10.1.0.M1–10.1.36, and 11.0.0.M1–11.0.4 are vulnerable when JNDIRealm is configured with GSSAPI authentication. Organizations using other Tomcat authentication methods (standard JDBC realms, file-based realms, or non-GSSAPI LDAP) are not affected. Patched versions are 7.0.110 or later, 8.5.101 or later, 9.0.101 or later, 10.1.37 or later, and 11.0.5 or later.

Exploitability

Exploitability is high. The vulnerability requires no user interaction, no special privileges, and network access to the Tomcat server. An attacker simply submits an authentication request with any username and an empty or arbitrary password—the missing GSSAPI validation step allows the bind to succeed. No exploit code or advanced tooling is needed; standard HTTP clients or LDAP tools suffice. The network-accessible nature (CVSS vector AV:N) and low attack complexity (AC:L) make this a trivial exploitation path for any adversary aware of the vulnerability.

Remediation

Upgrade immediately to Apache Tomcat 9.0.101, 10.1.37, 11.0.5, or the appropriate patched version for your branch. If immediate patching is not possible, consider disabling GSSAPI-based LDAP authentication in JNDIRealm temporarily and reverting to standard password-based LDAP or alternative authentication methods. Implement network-level access controls to restrict who can reach the Tomcat authentication endpoint. Monitor authentication logs for unusual patterns or failed logins followed by successful ones without credential entry.

Patch guidance

Tomcat releases patched versions regularly. Visit the Apache Tomcat security documentation to verify the exact patch version for your deployment branch. For production systems, test the patched version in a staging environment first to confirm no compatibility issues with custom realms or authentication plugins. Patching should be prioritized as HIGH due to the critical nature of authentication bypass; treat this similarly to remote code execution vulnerabilities in your patch lifecycle.

Detection guidance

Monitor Tomcat access and authentication logs for successful logins that lack corresponding password submissions or GSSAPI token exchanges. Look for authentication events with empty or null credentials. If GSSAPI debugging is enabled, inspect LDAP bind logs for completed binds that lack proper GSSAPI context establishment. Network-based detection is difficult without deep packet inspection into LDAP traffic; log-based detection is more practical. Consider deploying a WAF or authentication proxy to enforce secondary validation of LDAP authentication events.

Why prioritize this

This is a critical authentication bypass affecting multiple major Tomcat versions with trivial exploitation. The CVSS 7.3 (HIGH) score understates the business risk because authentication bypass often leads to downstream compromise. Organizations running Tomcat in production, especially in regulated industries or handling sensitive data, should treat this as a Priority 1 remediation. The ease of exploitation and lack of KEV status (indicating limited public exploit tooling at time of publication) suggest a window of opportunity for rapid patching before mass exploitation.

Risk score, explained

CVSS 3.1 score of 7.3 reflects the network-accessible attack vector (AV:N), low attack complexity (AC:L), no privilege requirement (PR:N), and no user interaction (UI:N). The confidentiality, integrity, and availability impacts are all low (L) because the vulnerability grants access but does not directly leak data, corrupt it, or crash the server—those are post-exploitation outcomes. However, the business risk is substantially higher because authentication bypass is a foundational control; once breached, all downstream security depends on the attacker's restraint. Security leaders should factor in the presence of sensitive data and regulatory context when deciding priority.

Frequently asked questions