Apache Tomcat 9.0.0.M1 < 9.0.102

CVE-2026-55957 is an authentication bypass in Apache Tomcat's JNDIRealm when configured to perform LDAP binds via GSSAPI (Kerberos). The bug is a missing critical step: when a user submits credentials, the realm validates them using the pre-configured Kerberos service principal instead of the user-supplied password, then marks the user as authenticated anyway. An attacker who knows a valid username can log in with any — or no — password. Affected versions span Tomcat 9.0.0.M1 through 9.0.100, with the fix landing in 9.0.101 (first GA release containing it: 9.0.102). The flaw also affects 11.0.0-M1–11.0.4, 10.1.0-M1–10.1.36, 8.5.0–8.5.100, and 7.0.0–7.0.109.

The vendor (Apache) rates this Important (their equivalent of HIGH), and Tenable's Nessus plugin 323710 flags it at CVSS 7.3 HIGH. However, this severity does not survive contact with reality. The vulnerability only fires when JNDIRealm is explicitly configured with GSSAPI as the bind authentication mechanism — a niche enterprise integration pattern used by a small minority of Tomcat deployments. The default Tomcat realm is UserDatabaseRealm backed by tomcat-users.xml; organizations using JDBC, DataSource, or even standard LDAP simple-bind JNDIRealm are unaffected. Tenable's own VPR score of 2.8 (Low) confirms their threat intelligence sees minimal real-world risk. The CVSS vector's C:L/I:L/A:L impact ratings further limit the blast radius even when exploitation succeeds. For the ~95%+ of Tomcat instances flagged by version-only detection that don't use this configuration, this is pure noise.

1. Confirm your Realm configuration before patching — Run grep -ri 'JNDIRealm' $CATALINA_BASE/conf/server.xml and check for authentication="GSSAPI". If your Realm is UserDatabaseRealm, JDBCRealm, DataSourceRealm, or JNDIRealm with simple/DIGEST-MD5 bind, you are not vulnerable and can deprioritize. Do this immediately to triage your fleet.
2. Switch JNDIRealm to simple bind as interim mitigation — If you are using JNDIRealm with GSSAPI, change the authentication attribute to simple (LDAP simple bind with a service account password) or switch to an application-layer auth mechanism. This eliminates the vulnerable code path without upgrading Tomcat. Validate LDAP connectivity after the change. Deploy within the noisgate 365-day remediation window (MEDIUM verdict — no mitigation SLA applies).
3. Upgrade to Tomcat 9.0.102+ — The definitive fix. Version 9.0.102 is the first generally available release containing the patch (commit 0cd21c0). For 10.x use 10.1.37+, for 11.x use 11.0.5+. Tomcat 8.5 and 7.0 are EOL — migrate to a supported branch. Target remediation within 365 days per noisgate remediation SLA for MEDIUM.
4. Deploy application-layer authentication — Modern Java applications should not rely solely on Tomcat container-managed authentication. Implement Spring Security, Apache Shiro, or an OAuth2/OIDC integration that validates credentials independently of the Tomcat Realm. This insulates you from all Realm-level vulnerabilities.

Run this script on each Tomcat host as a user with read access to the Tomcat configuration directory (typically $CATALINA_BASE/conf/). Invoke: chmod +x check_cve_2026_55957.sh && ./check_cve_2026_55957.sh /opt/tomcat (pass your CATALINA_BASE path as the first argument). No root required unless conf files are root-only.

#!/usr/bin/env bash
# check_cve_2026_55957.sh — Detect CVE-2026-55957 (JNDIRealm GSSAPI auth bypass)
# Usage: ./check_cve_2026_55957.sh <CATALINA_BASE>
# Exit codes: 1=VULNERABLE, 0=PATCHED, 2=UNKNOWN

set -euo pipefail

CATALINA_BASE="${1:-}"
if [[ -z "$CATALINA_BASE" ]]; then
  echo "UNKNOWN — Usage: $0 <CATALINA_BASE>"
  exit 2
fi

# --- Step 1: Determine Tomcat version ---
VERSION_FILE="$CATALINA_BASE/lib/catalina.jar"
if [[ ! -f "$VERSION_FILE" ]]; then
  echo "UNKNOWN — Cannot find catalina.jar at $CATALINA_BASE/lib/"
  exit 2
fi

VERSION=$(unzip -p "$VERSION_FILE" org/apache/catalina/util/ServerInfo.properties 2>/dev/null \
  | grep '^server.number=' | cut -d'=' -f2 | tr -d '[:space:]')

if [[ -z "$VERSION" ]]; then
  echo "UNKNOWN — Could not extract Tomcat version from catalina.jar"
  exit 2
fi

echo "Detected Tomcat version: $VERSION"

# --- Step 2: Check if JNDIRealm with GSSAPI is configured ---
SERVER_XML="$CATALINA_BASE/conf/server.xml"
GSSAPI_CONFIGURED=false
if [[ -f "$SERVER_XML" ]]; then
  if grep -qi 'JNDIRealm' "$SERVER_XML" && grep -qi 'GSSAPI' "$SERVER_XML"; then
    GSSAPI_CONFIGURED=true
    echo "WARNING: JNDIRealm with GSSAPI detected in server.xml"
  else
    echo "INFO: JNDIRealm with GSSAPI NOT found in server.xml"
  fi
else
  echo "WARNING: Cannot read $SERVER_XML — skipping config check"
fi

# --- Step 3: Version comparison for 9.x branch ---
# Vulnerable: 9.0.0 through 9.0.100 | Fixed: 9.0.101+
# Also check other branches
MAJOR=$(echo "$VERSION" | cut -d'.' -f1)
MINOR=$(echo "$VERSION" | cut -d'.' -f2)
PATCH=$(echo "$VERSION" | cut -d'.' -f3)

VULN_VERSION=false
case "$MAJOR" in
  9)
    if [[ "$PATCH" -le 100 ]]; then VULN_VERSION=true; fi
    ;;
  10)
    # 10.1.0-10.1.36 vulnerable
    SUB=$(echo "$MINOR.$PATCH" | awk -F. '{print $2}')
    if [[ "$MINOR" -eq 1 && "$PATCH" -le 36 ]]; then VULN_VERSION=true; fi
    ;;
  11)
    if [[ "$MINOR" -eq 0 && "$PATCH" -le 4 ]]; then VULN_VERSION=true; fi
    ;;
  8)
    if [[ "$MINOR" -eq 5 && "$PATCH" -le 100 ]]; then VULN_VERSION=true; fi
    ;;
  7)
    if [[ "$MINOR" -eq 0 && "$PATCH" -le 109 ]]; then VULN_VERSION=true; fi
    ;;
  *)
    echo "UNKNOWN — Unrecognized Tomcat major version: $MAJOR"
    exit 2
    ;;
esac

# --- Step 4: Verdict ---
if $VULN_VERSION; then
  if $GSSAPI_CONFIGURED; then
    echo "VULNERABLE — Tomcat $VERSION with JNDIRealm+GSSAPI is exploitable (CVE-2026-55957)"
    exit 1
  else
    echo "PATCHED (effectively) — Tomcat $VERSION is in the vulnerable range but JNDIRealm+GSSAPI is not configured. Version-only scanners will flag this; the host is not practically exploitable. Upgrade when convenient."
    exit 0
  fi
else
  echo "PATCHED — Tomcat $VERSION is at or above the fixed version."
  exit 0
fi

1. Tenable Plugin 323710
2. Apache Tomcat Security Advisory (oss-security)
3. GitHub Advisory GHSA-7895-gffq-w6jq
4. CyCognito Emerging Threat Analysis
5. Apache Tomcat 9.x Security Page
6. Fix Commit (9.x branch)
7. NVD Entry — CVE-2026-55957