CVE-2026-29145: Apache Tomcat CLIENT_CERT Authentication Vulnerability
Summary
CVE-2026-29145: Apache Tomcat: CLIENT_CERT authentication does not fail as expected. Affects org.apache.tomcat:tomcat-catalina across 3 version ranges.
>= 9.0.83, < 9.0.116
>= 10.1.0-M7, < 10.1.53
>= 11.0.0-M1, < 11.0.20
Fixed in 9.0.116, 10.1.53 or 11.0.20, depending on the release line you run. How to fix ↓
Also tracked for
- tomcat · Bitnami
The same CVE-2026-29145 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source implementation of the Java Servlet, JavaServer Pages, and Java Expression Language technologies. It is widely used for deploying Java applications and provides a robust environment for running web applications. The package is known for its performance, scalability, and ease of use. However, it has recently been found to have a vulnerability related to CLIENT_CERT authentication, which can lead to unauthorized access under certain conditions.
Vulnerability Detail
The vulnerability in Apache Tomcat arises from the CLIENT_CERT authentication mechanism not failing as expected when soft fail is disabled. This issue can potentially allow unauthorized users to gain access to resources that should be protected, leading to severe security implications. The vulnerability affects multiple versions of Apache Tomcat and Tomcat Native, making it critical for users to address it promptly.
How To Fix
Latest published version: 11.0.27 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 9.0.83, < 9.0.1169.0.116 -
>= 10.1.0-M7, < 10.1.5310.1.53 -
>= 11.0.0-M1, < 11.0.2011.0.20
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can enable soft fail for CLIENT_CERT authentication to mitigate the risk until they can apply the patch. This can be done by modifying the server configuration to allow for a more lenient authentication process.
Conclusion
The CLIENT_CERT authentication vulnerability in Apache Tomcat poses a significant risk to users by potentially allowing unauthorized access. It is crucial for users to upgrade to the patched versions of the affected packages to mitigate this risk. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for org.apache.tomcat:tomcat-catalina →
FAQ
The CVSS score of this vulnerability is 9.1, indicating a critical level of severity.
The affected versions include Apache Tomcat from 11.0.0-M1 through 11.0.18, from 10.1.0-M7 through 10.1.52, and from 9.0.83 through 9.0.115.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By simply using the pom.xml file, you can check if your application is affected by this vulnerability.
Yes, enabling soft fail for CLIENT_CERT authentication can serve as a temporary workaround until the patch is applied.
More information can be found in the advisory database on GitHub, which details the vulnerability and its implications.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tomcat:tomcat-catalina.
