CVE Intelligence
Analysis AI-assisted

CVE-2026-55276: Apache Tomcat: incorrect control flow in effective web.xml logging

Apache Tomcat omits special roles and empty authorisation constraints when logging the effective web.xml, a CWE-670 flaw. The CNA rates it critical with a CVSS 3.1 score of 9.1 and recommends upgrading to fixed releases in each affected branch. The record does not list it in CISA KEV, and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-55276 is a flaw in Apache Tomcat classified as CWE-670 (Always-Incorrect Control Flow Implementation). The CNA describes that special roles and empty authorisation constraints were not included when the effective web.xml was logged.

Impact

  • The published description does not state a direct consequence beyond the incomplete log output.
  • Because the log is incomplete, administrators may misread which roles and authorisation constraints are in effect (inference).
  • The CNA-assigned CVSS 3.1 score is 9.1 (critical), reflecting network reachability, low complexity, no required privileges and no user interaction, with high confidentiality and integrity impact as scored.

Affected products and versions

  • Apache Tomcat from 11.0.0-M1 through 11.0.22.
  • Apache Tomcat from 10.1.0-M1 through 10.1.55.
  • Apache Tomcat from 9.0.0.M1 through 9.0.118.
  • Apache Tomcat from 8.5.0 through 8.5.100.
  • According to the CNA, other end-of-support versions may also be affected.

The affected ranges in the record end before 9.0.119, before 10.1.56 and before 11.0.23.

Exploitation status

The record shows this CVE is not listed in the CISA KEV catalog. No confirmed exploitation appears in the sources consulted. The EPSS probability recorded is 0.00607, with a percentile of 0.47603.

Remediation and mitigation

  • The CNA recommends upgrading to Apache Tomcat 11.0.23, 10.1.56 or 9.0.119.
  • The record provides no fixed release for the 8.5 line; treat this as unknown and plan migration to a supported branch that receives a fix (inference).
  • Until patching is complete, verify roles and constraints directly against the deployed web.xml files rather than relying only on logged output.
  • Follow the Apache mailing list thread and the NVD entry for updates.

Detection guidance

  • Compare the effective security configuration reported in logs with the configuration files on disk to find missing roles or constraints.
  • Monitor for unexpected changes in role assignments or access rules after restarts or upgrades.

Limitations of the available information

  • The fixes list in the record is empty, so fixed versions rely on the CNA description.
  • The description gives no exploitation details, proof of concept or deployment conditions.
  • The record states no fix for the 8.5 line.
  • The sources consulted are limited to the references listed.

Frequently asked questions

Is this CVE known to be actively exploited?

The record shows it is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

Which versions should I upgrade to?

The CNA recommends 11.0.23, 10.1.56 or 9.0.119, depending on your branch. The record gives no fixed release for the 8.5 line.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.