CVE-2026-34487 — Apache Tomcat: Cloud membership for clustering component exposed the Kubernetes bearer token

Description (CNA)

Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clustering component of Apache Tomcat exposed the Kubernetes bearer token. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1.53, from 9.0.13 through 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.

Affected (CNA)

Vendor / product	Versions
Apache Software Foundation / Apache Tomcat	affected 11.0.0-M1 through 11.0.20; affected 10.1.0-M1 through 10.1.53; affected 9.0.13 through 9.0.116

CWE

CWE-532

References

https://lists.apache.org/thread/4xpkwolpkrj8v5xzp5nyovtlqp3y850h

ADP enrichment

CVE

No English description supplied.

http://www.openwall.com/lists/oss-security/2026/04/09/28

CISA-ADP

No English description supplied.

No references supplied.