Description
Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor.
This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116.
Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.
Metrics
CVSS 3.1 7.5/10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Tomcat | 11.0.20; 10.1.53; 9.0.116 |
| Red Hat | Red Hat Enterprise Linux 10 | — |
| Red Hat | Red Hat Enterprise Linux 10 | — |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | — |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | — |
| Red Hat | Red Hat Enterprise Linux 7 Extended Lifecycle Support | — |
| Red Hat | Red Hat Enterprise Linux 8 | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Telecommunications Update Service | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | — |
| Red Hat | Red Hat Enterprise Linux 9 | — |
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | — |
| Red Hat | Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions | — |
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | — |
| Red Hat | Red Hat JBoss Web Server 7.0.0 | — |
| Red Hat | Red Hat JBoss Web Server 7.0 on RHEL 10 | — |
| Red Hat | Red Hat JBoss Web Server 7.0 on RHEL 8 | — |
| Red Hat | Red Hat JBoss Web Server 7.0 on RHEL 9 | — |
| Red Hat | Red Hat Enterprise Linux 6 | — |
| Red Hat | Red Hat Enterprise Linux 8 | — |
| Red Hat | Red Hat Enterprise Linux 9 | — |
| Red Hat | Red Hat JBoss Web Server 5 | — |
| Red Hat | Red Hat JBoss Web Server 6 | — |
References
- https://lists.apache.org/thread/9510k5p5zdvt9pkkgtyp85mvwxo2qrlyMailing List, Vendor Advisory
- https://www.vicarius.io/vsociety/posts/cve-2026-34486-detection-script-rce-on-apache-tomcatThird Party Advisory
- https://www.vicarius.io/vsociety/posts/cve-2026-34486-mitigation-script-rce-on-apache-tomcatMitigation, Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:36787Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:36788Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:36789Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:36790Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:36876Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:36877Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:36878Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:36879Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:37136Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:37137Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:38505Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:39188Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:39189Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-34486Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2457027Issue Tracking, Third Party Advisory
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.jsonThird Party Advisory
- https://socradar.io/blog/snowlight-government-chinese-campaign/Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34486US Government Resource
Timeline
- Published
- Apr 9, 2026
- Last modified
- Oct 26, 2026
- Added to CISA KEV
- Aug 4, 2026
- NVD status
- Analyzed