CVE-2026-29145

CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M7 through 10.1.52, from 9.0.83 through 9.0.115; Apache Tomcat Native: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39, from 1.3.0 through 1.3.6, from 2.0.0 through 2.0.13. Users are recommended to upgrade to version Tomcat Native 1.3.7 or 2.0.14 and Tomcat 11.0.20, 10.1.53 and 9.0.116, which fix the issue.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread/yz5fxmhd2j43wgqykssdo7kltws57jfz	Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/04/09/23	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:apache:tomcat::::::::
	cpe:2.3:a:apache:tomcat::::::::
	cpe:2.3:a:apache:tomcat::::::::
	cpe:2.3:a:apache:tomcat:10.1.0:-::::::
	cpe:2.3:a:apache:tomcat:10.1.0:milestone10::::::
	cpe:2.3:a:apache:tomcat:10.1.0:milestone11::::::
	cpe:2.3:a:apache:tomcat:10.1.0:milestone12::::::
	cpe:2.3:a:apache:tomcat:10.1.0:milestone13::::::
	cpe:2.3:a:apache:tomcat:10.1.0:milestone14::::::
	cpe:2.3:a:apache:tomcat:10.1.0:milestone15::::::
	cpe:2.3:a:apache:tomcat:10.1.0:milestone16::::::
	cpe:2.3:a:apache:tomcat:10.1.0:milestone17::::::
	cpe:2.3:a:apache:tomcat:10.1.0:milestone18::::::
	cpe:2.3:a:apache:tomcat:10.1.0:milestone19::::::
	cpe:2.3:a:apache:tomcat:10.1.0:milestone20::::::
	cpe:2.3:a:apache:tomcat:10.1.0:milestone7::::::
	cpe:2.3:a:apache:tomcat:10.1.0:milestone8::::::
	cpe:2.3:a:apache:tomcat:10.1.0:milestone9::::::
	cpe:2.3:a:apache:tomcat_native::::::::
	cpe:2.3:a:apache:tomcat_native::::::::

History

No history.

Information

Published : 2026-04-09 20:16

Updated : 2026-06-17 10:29

NVD link : CVE-2026-29145

Mitre link : CVE-2026-29145

CVE.ORG link : CVE-2026-29145

JSON object : View

Products Affected

apache

tomcat_native
tomcat

CWE

CWE-287

Improper Authentication

{"id": "CVE-2026-29145", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-29145", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-10T18:10:50.492750Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache Tomcat", "versions": [{"status": "affected", "version": "11.0.0-M1", "versionType": "semver", "lessThanOrEqual": "11.0.18"}, {"status": "affected", "version": "10.1.0-M7", "versionType": "semver", "lessThanOrEqual": "10.1.52"}, {"status": "affected", "version": "9.0.83", "versionType": "semver", "lessThanOrEqual": "9.0.115"}, {"status": "unaffected", "version": "0", "versionType": "semver", "lessThanOrEqual": "8.5.100"}], "defaultStatus": "unaffected"}, {"vendor": "Apache Software Foundation", "product": "Apache Tomcat Native", "versions": [{"status": "affected", "version": "1.1.23", "versionType": "semver", "lessThanOrEqual": "1.1.34"}, {"status": "affected", "version": "1.2.0", "versionType": "semver", "lessThanOrEqual": "1.2.39"}, {"status": "affected", "version": "1.3.0", "versionType": "semver", "lessThanOrEqual": "1.3.6"}, {"status": "affected", "version": "2.0.0", "versionType": "semver", "lessThanOrEqual": "2.0.13"}], "defaultStatus": "unaffected"}]}], "published": "2026-04-09T20:16:24.447", "references": [{"url": "https://lists.apache.org/thread/yz5fxmhd2j43wgqykssdo7kltws57jfz", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/04/09/23", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M7 through 10.1.52, from 9.0.83 through 9.0.115; Apache Tomcat Native: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39, from 1.3.0 through 1.3.6, from 2.0.0 through 2.0.13.\n\nUsers are recommended to upgrade to version Tomcat Native 1.3.7 or 2.0.14 and Tomcat 11.0.20, 10.1.53 and 9.0.116, which fix the issue."}], "lastModified": "2026-06-17T10:29:42.010", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2F4C25F3-54B7-42C3-9CEE-853D64F538B9", "versionEndExcluding": "9.0.116", "versionStartIncluding": "9.0.83"}, {"criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6A9752F3-66FC-41BC-BBB9-50AC9A7DBC55", "versionEndExcluding": "10.1.53", "versionStartIncluding": "10.1.1"}, {"criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1F39B82B-0E67-459D-8065-2C6EE7970D0D", "versionEndExcluding": "11.0.20", "versionStartIncluding": "11.0.0"}, {"criteria": "cpe:2.3:a:apache:tomcat:10.1.0:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8AF99366-B85F-447F-90EF-E4F163193A78"}, {"criteria": "cpe:2.3:a:apache:tomcat:10.1.0:milestone10:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "33C71AE1-B38E-4783-BAC2-3CDA7B4D9EBA"}, {"criteria": "cpe:2.3:a:apache:tomcat:10.1.0:milestone11:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F6BD4180-D3E8-42AB-96B1-3869ECF47F6C"}, {"criteria": "cpe:2.3:a:apache:tomcat:10.1.0:milestone12:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "64668CCF-DBC9-442D-9E0F-FD40E1D0DDB7"}, {"criteria": "cpe:2.3:a:apache:tomcat:10.1.0:milestone13:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FC64BB57-4912-481E-AE8D-C8FCD36142BB"}, {"criteria": "cpe:2.3:a:apache:tomcat:10.1.0:milestone14:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "49B43BFD-6B6C-4E6D-A9D8-308709DDFB44"}, {"criteria": "cpe:2.3:a:apache:tomcat:10.1.0:milestone15:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "919C16BD-79A7-4597-8D23-2CBDED2EF615"}, {"criteria": "cpe:2.3:a:apache:tomcat:10.1.0:milestone16:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "81B27C03-D626-42EC-AE4E-1E66624908E3"}, {"criteria": "cpe:2.3:a:apache:tomcat:10.1.0:milestone17:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BD81405D-81A5-4683-A355-B39C912DAD2D"}, {"criteria": "cpe:2.3:a:apache:tomcat:10.1.0:milestone18:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2DCE3576-86BC-4BB8-A5FB-1274744DFD7F"}, {"criteria": "cpe:2.3:a:apache:tomcat:10.1.0:milestone19:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5571F54A-2EAC-41B6-BDA9-7D33CFE97F70"}, {"criteria": "cpe:2.3:a:apache:tomcat:10.1.0:milestone20:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ED30E850-C475-4133-BDE3-74CB3768D787"}, {"criteria": "cpe:2.3:a:apache:tomcat:10.1.0:milestone7:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "941FCF7B-FFB6-4967-95C7-BB3D32C73DAF"}, {"criteria": "cpe:2.3:a:apache:tomcat:10.1.0:milestone8:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CE1A9030-B397-4BA6-8E13-DA1503872DDB"}, {"criteria": "cpe:2.3:a:apache:tomcat:10.1.0:milestone9:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6284B74A-1051-40A7-9D74-380FEEEC3F88"}, {"criteria": "cpe:2.3:a:apache:tomcat_native:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4285FB15-C93B-498C-9DA1-E5C3364A0280", "versionEndExcluding": "1.3.7", "versionStartIncluding": "1.1.23"}, {"criteria": "cpe:2.3:a:apache:tomcat_native:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "89778321-0002-4D5F-85DB-EAE3CB9B53CA", "versionEndExcluding": "2.0.14", "versionStartIncluding": "2.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}