Improper Auth in Apache Tomcat DataSourceRealm before 11.0.25 (CVE-2026-68569)
CVE-2026-68569 Published on August 25, 2026
Apache Tomcat: Principal lookup can fail open in some cases
Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances (e.g. CLIENT-CERT, SPNEGO) that a user would be authenticated even if the user did not exist in the DataSourceRealm.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.
The following versions were EOL at the time the CVE was created but are
known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.
Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.
Vulnerability Analysis
CVE-2026-68569 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality and integrity, and no impact on availability.
Weakness Type
What is an authentification Vulnerability?
When an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct.
CVE-2026-68569 has been classified to as an authentification vulnerability or weakness.
Products Associated with CVE-2026-68569
Want to know whenever a new CVE is published for Apache Tomcat? stack.watch will email you.
Affected Versions
Apache Software Foundation Apache Tomcat:- Version 11.0.0-M1, <= 11.0.24 is affected.
- Version 10.1.0-M1, <= 10.1.57 is affected.
- Version 9.0.0.M1, <= 9.0.120 is affected.
- Version 8.5.0, <= 8.5.100 is affected.
- Version 7.0.0, <= 70.109 is affected.
- Before 7.0.0 is unknown.