First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-34487

HighCVSS 7.5/10Last modified Oct 26, 2026

Description

Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clustering component of Apache Tomcat exposed the Kubernetes bearer token.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1.53, from 9.0.13 through 9.0.116.

Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Tomcat	>= 11.0.0-M1, <= 11.0.20; >= 10.1.0-M1, <= 10.1.53; >= 9.0.13, <= 9.0.116

References

Timeline

Published: Apr 9, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-344887.0IP Setting Software contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. As a result, ar CVE-2026-344895.9Untrusted pointer dereference for some Hyperscan before version v5.4.2.1 within Ring 3: User Applications may allow a denial of service. Unp CVE-2026-34493.3Versions of the package @tootallnate/once before 3.0.1 are vulnerable to Incorrect Control Flow Scoping in promise resolving when AbortSigna CVE-2026-344905.5Cleartext storage of sensitive information vulnerability in Johnson Controls XAAP Application on Android allows an attacker on a jailbroken CVE-2026-344916.1Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Johnson Controls Metasys 14 and Johnso CVE-2026-344927.0External control of file name or path vulnerability in Johnson Controls Airwall allows : File Manipulation. This issue affects Airwall: bef CVE-2026-344937.2- On-Chip Debug Interface vulnerability in Johnson Controls EasyIO FS32 allows Collect Data from Common Resource Locations. This issue affe CVE-2026-344947.2- On-Chip Debug Interface vulnerability in Johnson Controls Neo Series MVP2 allows Collect Data from Common Resource Locations. This issue CVE-2026-344955.4Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Johnson Controls FM Systems Employee a CVE-2026-344967.1Cwe-269 vulnerability in Johnson Controls victor Web on Windows allows capec-233. This issue affects victor Web: before 7.1.CVE-2026-344975.4Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Johnson Controls FM Systems Employee allows C CVE-2026-344985.1Improper input validation vulnerability in Johnson Controls Illustra Standard - L4L China on Windows allows OS Command Injection. This issu

CVE-2026-34487: High severity, CVSS 7.5 | Vulnix