CVE-2026-34486

What is Apache Tomcat clustering and the EncryptInterceptor?

Apache Tomcat is the reference implementation of the Jakarta Servlet, JSP, and WebSocket specifications, and one of the most widely deployed Java application servers in existence.

This CVE affects a narrow part of it: Tomcat Tribes, the group communication framework behind Tomcat's clustering. When Tomcat nodes are clustered, Tribes carries session replication data and cluster control messages (deploy commands, membership announcements) between them.

EncryptInterceptor is an optional channel interceptor that applies pre-shared-key encryption to those inter-node messages. It exists specifically for operators who cannot place their cluster on an isolated, trusted network — the documented alternative is network segmentation. So the population affected by a bypass in it is, by construction, the population that had no other protection.

The data at stake is replicated HttpSession content: session identifiers and any serialized session attributes, which in practice means authentication tokens and user objects, plus cluster control messages.

Overview

CVE-2026-34486 is a missing-encryption vulnerability that allows the EncryptInterceptor to be bypassed, letting crafted cluster messages be processed without going through decryption and authentication. Apache rates it Important; NVD scores it CVSS 7.5.

It is a regression introduced by the fix for a previous vulnerability. Apache's own wording is direct: "An error in the fix for CVE-2026-29146 allowed the EncryptInterceptor to be bypassed." CVE-2026-29146, announced the same day, was a padding-oracle weakness arising from EncryptInterceptor defaulting to CBC mode. The fix changed the message-processing path and, in doing so, opened a route around the interceptor entirely.

The affected range is unusually narrow — only the single release on each branch that carried the CVE-2026-29146 fix is vulnerable.

CISA added it on 2026-08-04 with a BOD 26-04 deadline of 2026-08-07, and notes that it can be chained with CVE-2025-24813, the Tomcat partial-PUT deserialization RCE.

Affected Versions

Only one release per branch is affected because only that release shipped the CVE-2026-29146 fix that introduced the regression. (Tomcat 11.0.19 contained the fixes but its release vote failed, so 11.0.20 was the first published build carrying them — and therefore the only vulnerable 11.0.x release.)

You are only exposed if clustering is enabled and EncryptInterceptor is configured. Both are opt-in. A default Tomcat installation running one of these versions is not affected by this CVE.

Technical Details

Component. Apache Tomcat Tribes — EncryptInterceptor, the channel interceptor that encrypts inter-node cluster traffic using a pre-shared key.

Root cause. The fix for CVE-2026-29146 restructured message processing. An error in that restructuring left a path by which a crafted cluster message is accepted and processed without passing through decryption and authentication — so it is accepted in the clear. The interceptor is present and configured but not actually enforcing.

The fix commit is 1fab40ccc752e22639eccfe290d5624afad7eccd; the CVE-2026-29146 commit that introduced the regression was 6d955cceca841f2eabf2d6c46b59a8c7e1cd6eaa.

What is exposed. Replicated session data — session IDs and serialized session attributes such as authentication tokens and user objects — plus cluster control messages, all readable and injectable by anyone who can reach the Tribes channel.

Attack characteristics. Unauthenticated, no user interaction. Apache's CVSS 7.5 reflects a confidentiality-only impact (AV:N/AC:L/PR:N/UI:N). The attacker needs network reach to the Tribes membership and replication channel — default multicast port 45564 for membership, plus the replication receiver port.

On chaining. CISA's KEV entry states this vulnerability can be chained with CVE-2025-24813 (the Tomcat partial-PUT deserialization RCE), which is the documented route from an information-disclosure-scored bypass to code execution. Separately, an attacker able to inject accepted cluster messages is supplying input to Tribes' Java deserialization of received messages — but Apache scopes this CVE strictly to the interceptor bypass, and no published source documents that end-to-end path in detail. Treat CISA's CVE-2025-24813 chain as the sourced claim and anything beyond it as unproven.

Discovery

Reported to the Apache Tomcat security team on 2026-03-26 and announced on 2026-04-09, rated Important by Apache. No individual researcher is named in the Tomcat security advisories.

Not a zero-day — exploitation began roughly four months after fixed releases were available.

Note that some secondary coverage describes CVE-2026-29146 as a "critical 9.8 missing encryption" issue. That is inaccurate: Apache rates it Important and describes it as a padding-oracle weakness stemming from CBC mode being the default. Apache's framing is the authoritative one.

Exploitation Context

Palo Alto Networks Unit 42 reported on 2026-07-30 on a campaign run by a Chinese-speaking threat actor operating under the handles knaithe / KnYuan, based in Zhuhai. The actor built an offensive framework called the Hermes Agent that wires the DeepSeek model into semi-autonomous hunting of internet-exposed devices, and separately ran 1DayNews, an automated RCE-disclosure aggregation pipeline.

Against Tomcat specifically, Unit 42 documented a manual — not autonomous — sub-campaign attempting Java deserialization reverse shells against nine Apache Tomcat servers. Unit 42 does not state that these attempts succeeded; the confirmed compromises in that report were Citrix NetScaler (CVE-2026-3055) and Marimo notebook instances (CVE-2026-39987). The broader campaign spanned 460+ targets across 100+ countries between late April and early June, using a Linux C dropper named SNOWLIGHT.

No exposure counts have been published for this CVE, and no ransomware link has been reported.

Prioritization judgement: the exploited population is small, because it requires clustering plus EncryptInterceptor plus one specific release. But for organizations that match that profile, the interceptor was standing in for network isolation — meaning the fallback control is, by definition, absent.

Remediation

1. Upgrade to Tomcat 11.0.21, 10.1.54, or 9.0.117. The upgrade is a single patch release within your branch and carries minimal compatibility risk.
2. Confirm whether you are actually exposed before scrambling. Check your server.xml for a <Cluster> element and an EncryptInterceptor entry. No clustering, or clustering without EncryptInterceptor, means this CVE does not apply to you.
3. Segment the cluster network as a durable mitigation and interim control. Restrict the Tribes membership port (multicast 45564 by default) and the replication receiver port to trusted node addresses only. Proper segmentation makes EncryptInterceptor non-load-bearing — this is Apache's documented primary defence, with the interceptor as the fallback for operators who cannot segment.
4. Disable clustering entirely if it is not in use. Session replication configured but unused is pure attack surface.
5. Patch CVE-2025-24813 as well if you have not — CISA identifies it as chainable with this bypass, and that chain is the route to code execution.
6. Monitor for unexpected cluster membership joins, decryption failures in Tribes logs, and anomalous traffic on cluster ports. An unfamiliar node joining the cluster is the signal that matters.
7. If exploitation is suspected, invalidate all sessions and rotate session-borne credentials. Replicated session data includes session IDs and authentication tokens; patching does not invalidate what was already captured.