What is CVE-2026-55957?

CVE-2026-55957 is a high-severity vulnerability in Apache Tomcat, classified under Missing Critical Step in Authentication. CVSS score: 7.3/10. Published 2026-06-29.

How severe is CVE-2026-55957?

High severity. CVSS v3 base score is 7.3 out of 10.

Is CVE-2026-55957 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Apache Tomcat

CVE-2026-55957

Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.4, from 10.1.0-M1 through 10.1.36, from 9.0.0.M1 through 9.0.100, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Users are recommended to upgrade to version 11.0.5, 10.1.37 or 9.0.101, which fixes the issue.

EPSS: 0.030 (85.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.3 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L.

Affected products

Apache Tomcat
Apache Software Foundation Tomcat — versions 11.0.0-M1, 10.1.0-M1, 9.0.0.M1

Weakness classification (CWE)

CWE-304 — Missing Critical Step in Authentication

Public proof-of-concept exploits

mdvpat/CVE-2026-55957-PoC

References

security@apache.org (vendor-advisory, Mailing List, Vendor Advisory)
af854a3a-2127-422b-91ae-364da2661108 (Third Party Advisory)

Frequently asked questions

What is CVE-2026-55957?: CVE-2026-55957 is a high-severity vulnerability in Apache Tomcat, classified under Missing Critical Step in Authentication. CVSS score: 7.3/10. Published 2026-06-29.
How severe is CVE-2026-55957?: High severity. CVSS v3 base score is 7.3 out of 10.
Is CVE-2026-55957 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.