Skip to main content

 Security

CVE-2026-101296

Apache Tomcat: JNDIRealm credential validation bypass with non-GSSAPI SASL

Published2026-10-20
Last updated2026-11-11
ComponentApache Tomcat
SeverityCritical
PageSeeder statusNot affected

Summary

A missing credential verification step can allow authentication without the correct password when Tomcat JNDIRealm uses a non-GSSAPI SASL mechanism.

The issue affects Apache Tomcat 9.0.0.M1 through 9.0.122 in the 9.0 branch and is fixed in Tomcat 9.0.123. The bundled version, 9.0.120, falls within this version range; exploitability depends on the conditions described below.

The Critical classification reflects the CISA assessment in the CVE record: 9.1 (CVSS 4.0; CVSS 3.1 score 8.1, High). Apache rates this issue Important. The upstream severity is distinct from PageSeeder exposure.

For technical details, see the Apache Tomcat security advisory .

PageSeeder impact assessment

Affected dependencyApache Tomcat 9.0.120 (bundled)
PageSeeder versions assessedReviewed repository: 6.3003, bundling Tomcat 9.0.120; historical releases not independently assessed
Vulnerability statusNot affected
Conditions required for exploitationTomcat JNDIRealm authentication using a non-GSSAPI SASL mechanism.
Relevant PageSeeder configurationThe release and Docker configurations use LockOutRealm wrapping UserDatabaseRealm. No JNDIRealm configuration was found.
Assessment date2026-11-11

Assessment

PageSeeder is not affected by CVE-2026-101296 in the reviewed standard configuration because the required configuration or application usage was not found.

Required conditions for exploitation: Tomcat JNDIRealm authentication using a non-GSSAPI SASL mechanism.

Relevant PageSeeder configuration: The release and Docker configurations use LockOutRealm wrapping UserDatabaseRealm. No JNDIRealm configuration was found.

Evidence from source and configuration review:

  • Both supplied server.xml files configure UserDatabaseRealm within LockOutRealm.
  • No JNDIRealm or matching SASL authentication configuration was found in the repository.
  • The global JNDI UserDatabase resource is not a JNDIRealm authentication configuration.
  • Installer Linux server templates also use LockOutRealm wrapping UserDatabaseRealm. No JNDIRealm configuration was found in installer scripts or templates.

This assessment is limited to the repository revision and configuration reviewed on 11 November 2026. It does not independently verify the historical PageSeeder version range in the model advisory. Customised connectors, deployment descriptors, extensions and additional web applications may change exposure.

The PageSeeder installer source was also reviewed at commit a08323b (Windows, Linux EL7, EL8 and EL9). Installer review supports the standard configuration assessment; it does not establish the configuration of every deployed server. Linux RPM packaging marks server.xml CONFIG | NOREPLACE, so existing administrator changes can survive upgrades.

Recommended action

Administrators who enable JNDIRealm with non-GSSAPI SASL should upgrade to Tomcat 9.0.123 or later, or use an authentication configuration that does not meet these prerequisites.

For installations matching the reviewed unaffected configuration, no CVE-specific emergency change is required. Confirm the installed configuration before relying on this conclusion. Use a supported PageSeeder distribution containing an updated Tomcat where available; this advisory does not announce a PageSeeder release date or confirm that such a distribution has shipped.

Dependency maintenance recommendation: update the bundled Tomcat to 9.0.123 or a later supported release, which also incorporates fixes for the other Critical CVEs covered in this advisory set.

This assessment is based on source code and configuration review. It has not been verified through deployed server inspection or active exploit testing.

References

Created on , last edited on