← CVE Intelligence

CVE-2026-34486

Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor PUBLISHED

Description (CNA)

Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.

Affected (CNA)

Vendor / productVersions
Apache Software Foundation / Apache Tomcataffected 11.0.20; affected 10.1.53; affected 9.0.116

CWE

CWE-311

References

ADP enrichment

CISA-ADP

No English description supplied.

CVE

No English description supplied.

redhat-SADP

A flaw was found in Apache Tomcat. This vulnerability, categorized as Missing Encryption of Sensitive Data, arises from a bypass in the EncryptInterceptor, a component designed to ensure data encryption. This bypass, introduced as a fix for CVE-2026-29146, allows sensitive data to remain unencrypted, potentially leading to information disclosure.