CVE-2026-68569
Apache Tomcat: principal lookup fails open in DataSourceRealm and JDBCRealm
Technology
Apache Tomcat
CVSS Score
8.1 / 10.0
Affected Versions
11.0.0-M1 to 11.0.24; 10.1.0-M1 to 10.1.57; 9.0.0.M1 to 9.0.120; end of life but known affected: 8.5.0 to 8.5.100, 7.0.0 to 7.0.109
Upstream Fix
11.0.25; 10.1.59; 9.0.121
Published
August 25, 2026
OSSeva Coverage
Fixed upstream
Description
For some authentication methods, such as CLIENT-CERT and SPNEGO, a user was authenticated even if the user did not exist in the DataSourceRealm or JDBCRealm. Made public on 25 August 2026 and rated Important by the Tomcat security team. Fixed in 11.0.25, 10.1.59 and 9.0.121.
Is your Apache Tomcat deployment affected?
If you're running 11.0.0-M1 to 11.0.24; 10.1.0-M1 to 10.1.57; 9.0.0.M1 to 9.0.120; end of life but known affected: 8.5.0 to 8.5.100, 7.0.0 to 7.0.109, you need this patch. Book a discovery call to get covered.
Get a quote
Running Apache Tomcat 11.0.0-M1 to 11.0.24; 10.1.0-M1 to 10.1.57; 9.0.0.M1 to 9.0.120; end of life but known affected: 8.5.0 to 8.5.100, 7.0.0 to 7.0.109?
Send your work email and a senior engineer will tell you whether this CVE applies to your versions and who patches it. Reply within 1 business day.
Prefer to talk or read more first?