CVE-2026-101296
CVE-2026-101296 is a critical-severity vulnerability with a CVSS 4.0 base score of 9.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-304.
Key facts
- Severity: Critical (CVSS 4.0 base score 9.1)
- EPSS exploit prediction: 1% (51st percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-304
- Published:
- Last modified:
Description
A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI SASL authentication mechanism allowed attackers to authenticate without providing the correct password. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.26, from 10.1.0-M1 through 10.1.60, from 9.0.0.M1 through 9.0.122. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.
Frequently asked questions
- What is CVE-2026-101296?
- A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI SASL authentication mechanism allowed attackers to authenticate without providing the correct password. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.26, from 10.1.0-M1 through 10.1.60, from 9.0.0.M1 through 9.0.122. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.
- How severe is CVE-2026-101296?
- CVE-2026-101296 has a CVSS 4.0 base score of 9.1, rated critical severity.
- Is CVE-2026-101296 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (51st percentile), an estimate of the probability of exploitation in the next 30 days.
- How do I fix CVE-2026-101296?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
- When was CVE-2026-101296 published?
- CVE-2026-101296 was published on 2026-10-20 and last updated on 2026-10-21.
References
- https://lists.apache.org/thread.html/bl52b9go9ckoov8x4v3dt6rkm573cygd
- http://www.openwall.com/lists/oss-security/2026/10/20/26
Other CWE-304 vulnerabilities
- CVE-2023-54391 — Critical (CVSS 9.8): Proxmox Virtual Environment (VE) 7.0 through 8.0 contains an authentication bypass vulnerability in…
- CVE-2024-8954 — Critical (CVSS 9.8): In composiohq/composio version 0.5.10, the API does not validate the `x-api-key` header's value during the…
- CVE-2024-2172 — Critical (CVSS 9.8): The Malware Scanner plugin and the Web Application Firewall plugin for WordPress (both by MiniOrange) are vulnerable to…
- CVE-2026-94052 — Critical (CVSS 9.1): A missing check in LdapPasswordAuthenticator in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 or…
- CVE-2026-59564 — Critical (CVSS 9.1): An authentication bypass issue exists in communications between affected versions of the Zscaler Client Connector and…
- CVE-2026-61466 — Critical (CVSS 9.1): In Apache CXF's OAuth2 Dynamic Client Registration endpoint, the authorization server accepts and stores the `scope`…