Apache Tomcat contains a Missing Encryption of Sensitive Data vulnerability (CWE-311), rated Important by the Apache Software Foundation, in which the EncryptInterceptor component of the Tomcat Tribes clustering framework can be bypassed. The weakness was introduced by the fix for an earlier vulnerability, CVE-2026-29146.

The vulnerability affects Apache Tomcat across the following versions:

• Apache Tomcat 11.0.20 - Solution: upgrade to 11.0.21 or above
• Apache Tomcat 10.1.53 - Solution: upgrade to 10.1.54 or above
• Apache Tomcat 9.0.116 - Solution: upgrade to 9.0.117 or above

The vulnerability is only exploitable where Tomcat Tribes clustering is enabled and the EncryptInterceptor is configured. Standalone Tomcat instances that do not use session replication or clustering are not affected by this issue.

Background - how this vulnerability is exploited:

• An attacker with network reachability to the Tribes receiver, typically TCP port 4000, connects directly. No credentials are required and the receiver does not authenticate incoming cluster messages.
• The attacker sends a crafted, unencrypted Tribes frame containing a serialised Java object.
• EncryptInterceptor attempts to decrypt the payload and fails. The failure is logged, but because of the regression the message is still passed onward rather than dropped.
• The attacker-controlled bytes reach the deserialization routine and are processed by ObjectInputStream.readObject(). Where a usable gadget chain is present on the classpath, this results in remote code execution in the context of the Tomcat process, which in some deployments runs with high privilege.

CERTVU recommends the following:

• Apply the Apache Tomcat security update for this vulnerability without delay: upgrade to 11.0.21, 10.1.54 or 9.0.117 or above as appropriate to your branch.
• Confirm which Tomcat version is actually deployed before assuming remediation. An upgrade performed earlier in 2026 to address CVE-2026-29146 does not remediate this issue and may be the reason a system is exposed.
• Restrict the Tribes receiver port, typically TCP 4000, at the network and host firewall level so that it is reachable only from known cluster node addresses. This is an effective interim compensating control where immediate patching is not possible.