Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146…

CVE-2026-34486 is a regression introduced by the fix for CVE-2026-29146 (a padding oracle in the Tribes EncryptInterceptor). The patch switched encryption modes but inadvertently caused the EncryptInterceptor to fail open — when decryption fails, the message is accepted and processed anyway instead of being dropped. An attacker who can reach the Tribes receiver port (default TCP/4000) can send a crafted Java deserialization payload that bypasses encryption entirely, achieving unauthenticated remote code execution. Affected versions are *exactly one release per branch*: 9.0.116, 10.1.53, and 11.0.20. Fixed in 9.0.117, 10.1.54, and 11.0.21 respectively.

The vendor rated this Important / HIGH (7.5) with a confidentiality-only CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), which undersells the real impact — public PoCs demonstrate full RCE, not just data leakage. However, the 7.5 is partially justified by the heavy prerequisite stack: Tribes clustering must be enabled, EncryptInterceptor must be configured, port 4000 must be reachable, and deserialization gadgets must exist on the classpath. The biggest mitigant is the *absurdly narrow version window* — only organizations that patched CVE-2026-29146 but stopped one version short are exposed. Despite that, CISA added this to the KEV on August 4, 2026 after a Chinese threat actor was caught autonomously scanning and exploiting it across 460+ targets.

Why this verdict

• KEV override: CISA added this to the KEV on August 4, 2026 with a 2-day remediation deadline for federal agencies. Active exploitation by a named threat actor (knaithe/KnYuan) using AI-augmented autonomous scanning across 460+ targets eliminates any theoretical-only risk argument.
• Unauthenticated RCE with public PoC: Despite the vendor's C:H-only CVSS vector, the striga-ai and 404-src PoCs demonstrate full code execution via CC6 deserialization gadgets. The real impact is RCE, not just information disclosure.
• Narrow version window (downward pressure): Only one version per branch (9.0.116, 10.1.53, 11.0.20) is affected. Organizations that skipped CVE-2026-29146's patch or already upgraded past it are not vulnerable. This dramatically shrinks the exposed population.
• Clustering prerequisite (downward pressure): Tribes clustering is an opt-in configuration. The majority of Tomcat deployments are standalone or use external session stores (Redis, Memcached). The fraction running Tribes with EncryptInterceptor is small — likely single-digit percentages of all Tomcat installs.
• Role multiplier: Tomcat instances in clustered configurations tend to be production application servers (typical role: line-of-business tier). In high-value roles — e.g., Tomcat fronting identity services, internal APIs with database credentials, or CI/CD artifact serving — RCE gives the attacker a pivot into backend data tiers. This is a *host-to-tenant* blast radius in most deployments, occasionally *tenant-to-domain* where the Tomcat service account has AD credentials. The clustering use-case itself signals production-grade deployment, making the affected population higher-value on average than a random Tomcat instance.

Why not higher?

Despite the KEV listing and RCE impact, CRITICAL is not warranted because the affected population is *extraordinarily narrow* — exactly one version per branch, requiring opt-in Tribes clustering with EncryptInterceptor, reachable port 4000, and classpath gadgets. Tomcat is not a canonically high-value-role component (it is not a domain controller, hypervisor, identity provider, or security agent). The blast radius is host-to-tenant, not fleet-scale.

Why not lower?

Active exploitation confirmed by CISA KEV with a named threat actor and 460+ observed targets makes anything below HIGH indefensible. The EPSS score of 0.43 (top 1%) independently corroborates real-world weaponization. The attack is unauthenticated and requires no user interaction, with multiple public PoCs lowering the barrier to entry for copycat attackers.

1. Block TCP/4000 at the network boundary immediately — Firewall rules or security group changes to ensure the Tribes receiver port is only reachable from other cluster members on a dedicated VLAN. This is the single fastest mitigation — deploy within hours given the KEV listing. Even without this CVE, Tribes ports should never be internet-facing.
2. Apply the vendor patch (9.0.117 / 10.1.54 / 11.0.21) — The definitive fix. These versions restore proper EncryptInterceptor enforcement. Given the KEV listing, patch immediately — do not wait for a maintenance window. The patch has been available since April 4, 2026.
3. Configure JEP 290 deserialization filters — Add -Djdk.serialFilter to restrict deserialization to known-safe classes. This blocks the CC6 gadget chain used in public PoCs. Deploy within the noisgate mitigation SLA of 30 days as a defense-in-depth layer even after patching.
4. Audit classpath for unnecessary gadget libraries — Remove or update commons-collections, commons-beanutils, and other known deserialization gadget sources from the Tomcat classpath if not required by your application. Reduces the exploitability of this and future deserialization flaws.
5. Monitor for anomalous Tomcat child processes — EDR rules or auditd policies to alert on the Tomcat JVM spawning shells, curl, wget, or other unexpected child processes. Detects post-exploitation activity even if the initial exploit lands.

Run this script on each Tomcat host to check the installed version against the three affected releases. Execute as any user with read access to the Tomcat installation directory. Example: bash check_cve_2026_34486.sh /opt/tomcat

#!/usr/bin/env bash
# check_cve_2026_34486.sh — Detect CVE-2026-34486 (Tomcat EncryptInterceptor bypass)
# Usage: bash check_cve_2026_34486.sh [CATALINA_HOME]
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

CATALINA_HOME="${1:-${CATALINA_HOME:-/opt/tomcat}}"
VERSION_FILE="$CATALINA_HOME/lib/catalina.jar"

if [ ! -f "$VERSION_FILE" ]; then
  echo "UNKNOWN — catalina.jar not found at $CATALINA_HOME/lib/catalina.jar"
  exit 2
fi

# Extract version from ServerInfo.properties inside catalina.jar
VERSION=$(unzip -p "$VERSION_FILE" org/apache/catalina/util/ServerInfo.properties 2>/dev/null | grep 'server.number=' | cut -d= -f2 | tr -d '[:space:]')

if [ -z "$VERSION" ]; then
  echo "UNKNOWN — could not extract version from catalina.jar"
  exit 2
fi

echo "Detected Tomcat version: $VERSION"

# Check against the three affected versions
case "$VERSION" in
  9.0.116|10.1.53|11.0.20)
    echo "VULNERABLE — $VERSION is affected by CVE-2026-34486"
    # Additionally check if Tribes clustering is configured
    SERVER_XML="$CATALINA_HOME/conf/server.xml"
    if [ -f "$SERVER_XML" ]; then
      if grep -qi 'Cluster' "$SERVER_XML" && grep -qi 'EncryptInterceptor' "$SERVER_XML"; then
        echo "WARNING — Tribes clustering with EncryptInterceptor is configured. RCE is possible if port 4000 is reachable."
      elif grep -qi 'Cluster' "$SERVER_XML"; then
        echo "NOTE — Clustering enabled but EncryptInterceptor not found. Cluster was already unencrypted (pre-existing risk)."
      else
        echo "NOTE — Clustering does not appear enabled in server.xml. Exploitation requires Tribes clustering."
      fi
    fi
    exit 1
    ;;
  *)
    echo "PATCHED — $VERSION is not one of the three affected releases (9.0.116, 10.1.53, 11.0.20)"
    exit 0
    ;;
esac

Sources

1. Apache Tomcat 11 Security Advisories
2. Apache Tomcat 9 Security Advisories
3. The Hacker News — CISA Flags Tomcat Flaw as Actively Exploited
4. striga-ai PoC — CVE-2026-34486
5. Field Effect — Public Exploit Code for Tomcat Clustering Flaw
6. Red Hat Bugzilla — CVE-2026-34486
7. CyberSecurity News — Tomcat EncryptInterceptor Bypass
8. HeroDevs — Apache Tomcat CVE Round-Up April 2026