CVE-2026-86248: Apache Tomcat CLIENT_CERT Authentication Soft-Fail Issue
Summary
CVE-2026-86248: CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat. Affects tomcat across 3 version ranges.
>= 9.0.92, < 9.0.122
>= 10.1.22, < 10.1.60
>= 11.0.0, < 11.0.26
Fixed in 9.0.122, 10.1.60 or 11.0.26, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source implementation of the Java Servlet, JavaServer Pages, and Java Expression Language technologies. It is widely used for deploying Java applications and provides a robust environment for running web applications. The package is known for its scalability, reliability, and extensive feature set. However, it has a vulnerability related to CLIENT_CERT authentication that can lead to unexpected behavior under certain configurations.
Vulnerability Detail
The vulnerability arises from an incomplete fix for CVE-2026-34500, where CLIENT_CERT authentication does not fail as expected when soft-fail is disabled. This can lead to scenarios where authentication may succeed even when it should not, potentially allowing unauthorized access to sensitive resources. The issue affects multiple versions of Apache Tomcat, specifically from 11.0.0 through 11.0.25, from 10.1.22 through 10.1.59, and from 9.0.92 through 9.0.121.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 9.0.92, < 9.0.1229.0.122 -
>= 10.1.22, < 10.1.6010.1.60 -
>= 11.0.0, < 11.0.2611.0.26
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can review their CLIENT_CERT authentication configurations to ensure that soft-fail is appropriately set and monitor logs for any unauthorized access attempts. However, upgrading to the patched version is strongly recommended for a permanent solution.
Conclusion
The CVE-2026-86248 vulnerability in Apache Tomcat poses a significant risk to applications relying on CLIENT_CERT authentication. Users are strongly advised to upgrade to the latest patched versions to mitigate this risk and ensure the security of their applications.
See every vulnerability recorded for tomcat →
FAQ
CVE-2026-86248 is a vulnerability in Apache Tomcat that affects CLIENT_CERT authentication, allowing it to soft-fail even when disabled.
The affected versions are from 11.0.0 to 11.0.25, 10.1.22 to 10.1.59, and 9.0.92 to 9.0.121.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate upgrading is not possible, review your CLIENT_CERT configurations and monitor for unauthorized access as a temporary measure.
More detailed information can be found in the official Apache Tomcat security advisories and the CVE database.
References
Related vulnerabilities
Recent vulnerabilities recorded for tomcat.
