UpHeron
All vulnerabilities

Servers and applications

CVE-2026-101296

Apache Tomcat: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms

Severity
Unrated
Published
20 Oct 2026
Last changed
20 Oct 2026
Added to UpHeron
20 Oct 2026
Sources
CVE Program

Affected software

SoftwareAffected versions
Apache TomcatServers and applications · cna:apache software foundation|apache tomcat
  • From 7.0.0 up to 7.0.109
  • From 8.5.0 up to 8.5.100
  • From 9.0.0.M1 up to 9.0.122
  • From 10.1.0-M1 up to 10.1.60
  • From 11.0.0-M1 up to 11.0.26

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-101296