CVE-2026-55955: 
Apache Tomcat vulnerability analysis and mitigation

CVE-2026-55955 is an Improper Authentication vulnerability in Apache Tomcat's cluster component that allows unauthenticated attackers to conduct replay attacks against the EncryptionInterceptor. Disclosed on June 29, 2026 by Apache's Mark Thomas via the oss-security mailing list, it affects Apache Tomcat versions 11.0.0-M1 through 11.0.22, 10.1.0-M1 through 10.1.55, 9.0.13 through 9.0.118, 8.5.38 through 8.5.100, and 7.0.100 through 7.0.109. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, oss-security).

The root cause is classified as CWE-287 (Improper Authentication) and CWE-294 (Authentication Bypass by Capture-Replay). The EncryptionInterceptor in Tomcat's cluster component encrypts inter-node messages but fails to implement replay protection mechanisms such as nonces, timestamps, or message sequence numbers. An attacker with network access to the cluster communication channel can capture legitimate encrypted cluster messages and retransmit them to bypass authentication controls, causing nodes to accept previously valid but replayed messages. No special privileges or user interaction are required for exploitation (oss-security, GitHub Advisory).

Successful exploitation allows an unauthenticated network attacker to replay captured cluster messages, resulting in low-level confidentiality and integrity impacts on cluster communications — specifically, the ability to read or inject replayed cluster data. Availability is not directly impacted. The scope is limited to the cluster component itself; however, in environments where cluster messages carry session replication data or application state, replayed messages could lead to unauthorized session manipulation or data exposure across cluster nodes (GitHub Advisory, bugzilla.redhat.com).

1. Reconnaissance: Identify Apache Tomcat instances running in cluster mode with EncryptionInterceptor configured. Cluster communication typically occurs on a dedicated multicast or unicast port (default: 4000 or configured in server.xml).
2. Network positioning: Gain access to the network segment where Tomcat cluster nodes communicate (e.g., internal network, VLAN, or via a compromised host on the same subnet).
3. Traffic capture: Use a packet capture tool (e.g., tcpdump, Wireshark) to intercept encrypted cluster messages exchanged between Tomcat nodes on the cluster communication port.
4. Message replay: Retransmit one or more captured encrypted cluster messages to a target Tomcat node. Because the EncryptionInterceptor lacks replay protection, the node will accept and process the replayed message as legitimate.
5. Achieve objective: Depending on the content of replayed messages (e.g., session replication data, cluster commands), the attacker may manipulate application state, inject stale session data, or observe cluster behavior responses to infer information (oss-security, GitHub Advisory).

• Network: Unexpected or duplicate cluster communication packets on Tomcat cluster ports (commonly TCP/UDP 4000 or as configured); repeated identical encrypted payloads sent to cluster nodes from an unexpected source IP.
• Logs: Tomcat cluster logs (catalina.out) showing repeated processing of identical cluster messages or session replication events from unexpected sources; anomalous cluster membership changes.
• Process/Behavior: Unexpected session state changes or application behavior inconsistencies across cluster nodes that do not correspond to legitimate user activity, potentially indicating replayed session replication messages.

Apache has released patched versions: 11.0.23, 10.1.56, and 9.0.119. Users on versions 8.5.x and 7.x should evaluate alternative mitigations, as fixed versions are not explicitly listed for those branches — options include restricting network access to cluster communication channels using firewall rules, or disabling cluster mode if it is not required. Upgrading to a patched version is the recommended long-term solution (oss-security, GitHub Advisory).

The vulnerability was disclosed by Apache Tomcat committer Mark Thomas with a severity rating of "low" on the oss-security mailing list, reflecting the limited practical exploitability due to the requirement for network access to cluster channels (oss-security). Security news outlet SecurityOnline.info covered the disclosure as part of a broader Apache Tomcat vulnerability roundup, and HeroDevs published a vulnerability directory entry and blog post summarizing the June 2026 Tomcat CVE batch including CVE-2026-55955 (HeroDevs Blog). Red Hat tracked the issue via Bugzilla and assigned it medium priority (bugzilla.redhat.com).