CVE-2026-43512: Apache Tomcat Digest Authenticator Vulnerability Allows Unauthorized Access
Summary
CVE-2026-43512: Apache Tomcat - Digest authenticator will authenticate any unknown user. Affects org.apache.tomcat.embed:tomcat-embed-core across 3 version ranges.
< 9.0.118
>= 10.1.0-M1, < 10.1.55
>= 11.0.0-M1, < 11.0.22
Fixed in 9.0.118, 10.1.55 or 11.0.22, depending on the release line you run. How to fix ↓
Also tracked for
- tomcat · Bitnami
The same CVE-2026-43512 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is a widely-used open-source implementation of the Java Servlet, JavaServer Pages, and Java Expression Language technologies. It serves as a web server and servlet container, enabling developers to deploy Java applications. The affected versions of Tomcat include 11.0.0-M1 to 11.0.21, 10.1.0-M1 to 10.1.54, and 9.0.0.M1 to 9.0.117, which are vulnerable to a critical security issue in the DIGEST authentication mechanism.
Vulnerability Detail
The vulnerability arises when DIGEST authentication is configured in Apache Tomcat. It allows any user not recognized by the configured Realm to be authenticated if they provide the password 'null'. This flaw can lead to unauthorized access to sensitive resources, potentially compromising the security of applications running on the affected Tomcat versions.
How To Fix
Latest published version: 11.0.27 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 9.0.1189.0.118 -
>= 10.1.0-M1, < 10.1.5510.1.55 -
>= 11.0.0-M1, < 11.0.2211.0.22
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, consider disabling DIGEST authentication until the upgrade can be applied. This can be done by modifying the server.xml configuration file to remove or comment out the DIGEST authentication settings.
Conclusion
In summary, CVE-2026-43512 is a critical vulnerability in Apache Tomcat's DIGEST authentication mechanism that allows unauthorized access. Users are strongly advised to upgrade to the latest patched versions to mitigate this risk. Temporary workarounds are available, but upgrading is the best long-term solution.
See every vulnerability recorded for org.apache.tomcat.embed:tomcat-embed-core →
FAQ
The CVSS score of this vulnerability is 9.8, indicating a critical level of severity.
Affected versions include Apache Tomcat 11.0.0-M1 to 11.0.21, 10.1.0-M1 to 10.1.54, and 9.0.0.M1 to 9.0.117.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate upgrading is not possible, consider disabling DIGEST authentication as a temporary workaround.
The vulnerability allows unauthorized users to gain access to resources by exploiting the DIGEST authentication mechanism, potentially leading to data breaches.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tomcat.embed:tomcat-embed-core.
