CVE-2026-29145
published 2026-04-09CVE-2026-29145: CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native. This…
PriorityP261critical9.1CVSS 3.1
AVNACLPRNUINSUCHIHAN
EPSS
0.71%
49.6th percentile
CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M7 through 10.1.52, from 9.0.83 through 9.0.115; Apache Tomcat Native: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39, from 1.3.0 through 1.3.6, from 2.0.0 through 2.0.13.
Users are recommended to upgrade to version Tomcat Native 1.3.7 or 2.0.14 and Tomcat 11.0.20, 10.1.53 and 9.0.116, which fix the issue.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | tomcat | — | — |
| apache | tomcat | >= 10.1.1 < 10.1.53 | 10.1.53 |
| apache | tomcat | >= 11.0.0 < 11.0.20 | 11.0.20 |
| apache | tomcat | >= 9.0.83 < 9.0.116 | 9.0.116 |
| apache | tomcat_native | >= 1.1.23 < 1.3.7 | 1.3.7 |
| apache | tomcat_native | >= 2.0.0 < 2.0.14 | 2.0.14 |
| apache_software_foundation | apache_tomcat | 10.1.0-M7 – 10.1.52 | — |
| apache_software_foundation | apache_tomcat | 11.0.0-M1 – 11.0.18 | — |
| apache_software_foundation | apache_tomcat | 9.0.83 – 9.0.115 | — |
| apache_software_foundation | apache_tomcat_native | 1.1.23 – 1.1.34 | — |
| apache_software_foundation | apache_tomcat_native | 1.2.0 – 1.2.39 | — |
| apache_software_foundation | apache_tomcat_native | 1.3.0 – 1.3.6 | — |
| apache_software_foundation | apache_tomcat_native | 2.0.0 – 2.0.13 | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect Apache Tomcat CLIENT_CERT authentication bypass attempts by monitoring for successful authentication to certificate-protected resources without a valid client certificate being presented, particularly when softFail is disabled in the Tomcat configuration. ↗
- →Audit Apache Tomcat conf/server.xml for SSLHostConfig or Connector elements where clientAuth is not set to 'required' and softFail is not explicitly enabled — these configurations are the precondition for exploitation. ↗
- →Flag access to resources protected by CLIENT_CERT authentication on affected Tomcat versions (9.0.83–9.0.115, 10.1.0-M7–10.1.52, 11.0.0-M1–11.0.18) where no client certificate was supplied in the TLS handshake but the request was not rejected. ↗
- ·Vulnerability is only exploitable when CLIENT_CERT authentication is configured AND 'soft fail' is explicitly disabled. Deployments not using CLIENT_CERT auth are not affected. ↗
- ·Affected Tomcat Native versions span three release branches: 1.1.23–1.1.34, 1.2.0–1.2.39, and 1.3.0–1.3.6, as well as 2.0.0–2.0.13. All must be checked when assessing the native connector layer. ↗
- ·Red Hat has deferred fixes across RHEL 7, 8, 9, 10 and JBoss Web Server 5 & 6 packages; patched upstream versions are Tomcat 9.0.116, 10.1.53, 11.0.20 and Tomcat Native 1.3.7 / 2.0.14. ↗
- ·A Tomcat service restart is required after any conf/server.xml configuration change for the mitigation to take effect. ↗
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
vendor_redhat9.1CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
Apache Tomcat: Apache Tomcat: Authentication bypass due to CLIENT_CERT soft fail misconfiguration
vendor_redhat·2026-04-09·CVSS 9.1
CVE-2026-29145 [CRITICAL] CWE-303 Apache Tomcat: Apache Tomcat: Authentication bypass due to CLIENT_CERT soft fail misconfiguration
Apache Tomcat: Apache Tomcat: Authentication bypass due to CLIENT_CERT soft fail misconfiguration
CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M7 through 10.1.52, from 9.0.83 through 9.0.115; Apache Tomcat Native: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39, from 1.3.0 through 1.3.6, from 2.0.0 through 2.0.13.
Users are recommended to upgrade to version Tomcat Native 1.3.7 or 2.0.14 and Tomcat 11.0.20, 10.1.53 and 9.0.116, which fix the issue.
A flaw was found in Apache Tomcat and Apache Tomcat Native. When CLIENT_CERT authentication is configured with "soft fail" disabled, the authentication pr
GHSA
GHSA-95jq-rwvf-vjx4: CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Nativ
ghsa_unreviewed·2026-04-09
CVE-2026-29145 GHSA-95jq-rwvf-vjx4: CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Nativ
CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M7 through 10.1.52, from 9.0.83 through 9.0.115; Apache Tomcat Native: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39, from 1.3.0 through 1.3.6, from 2.0.0 through 2.0.13.
Users are recommended to upgrade to version Tomcat Native 1.3.7 or 2.0.14 and Tomcat 11.0.20, 10.1.53 and 9.0.116, which fix the issue.
VulDB
Apache Tomcat up to 8.5.99/9.0.115/10.1.52/11.0.18 CLIENT_CERT Authentication improper authentication
vuldb·2026-04-09·CVSS 9.1
CVE-2026-29145 [CRITICAL] Apache Tomcat up to 8.5.99/9.0.115/10.1.52/11.0.18 CLIENT_CERT Authentication improper authentication
A vulnerability labeled as critical has been found in Apache Tomcat up to 8.5.99/9.0.115/10.1.52/11.0.18. The impacted element is an unknown function of the component CLIENT_CERT Authentication. Such manipulation leads to improper authentication.
This vulnerability is referenced as CVE-2026-29145. It is possible to launch the attack remotely. No exploit is available.
The affected component should be upgraded.
GHSA
Apache Tomcat: CLIENT_CERT authentication does not fail as expected
ghsa·2026-04-09
CVE-2026-29145 [CRITICAL] CWE-287 Apache Tomcat: CLIENT_CERT authentication does not fail as expected
Apache Tomcat: CLIENT_CERT authentication does not fail as expected
CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M7 through 10.1.52, from 9.0.83 through 9.0.115; Apache Tomcat Native: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39, from 1.3.0 through 1.3.6, from 2.0.0 through 2.0.13.
Users are recommended to upgrade to version Tomcat Native 1.3.7 or 2.0.14 and Tomcat 11.0.20, 10.1.53 and 9.0.116, which fix the issue.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-29145 tomcat: Apache Tomcat: Authentication bypass due to CLIENT_CERT soft fail misconfiguration [fedora-all]
bugzilla·2026-04-10·CVSS 9.1
CVE-2026-29145 [CRITICAL] CVE-2026-29145 tomcat: Apache Tomcat: Authentication bypass due to CLIENT_CERT soft fail misconfiguration [fedora-all]
CVE-2026-29145 tomcat: Apache Tomcat: Authentication bypass due to CLIENT_CERT soft fail misconfiguration [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-29145 Apache Tomcat: Apache Tomcat: Authentication bypass due to CLIENT_CERT soft fail misconfiguration
bugzilla·2026-04-09·CVSS 9.1
CVE-2026-29145 [CRITICAL] CVE-2026-29145 Apache Tomcat: Apache Tomcat: Authentication bypass due to CLIENT_CERT soft fail misconfiguration
CVE-2026-29145 Apache Tomcat: Apache Tomcat: Authentication bypass due to CLIENT_CERT soft fail misconfiguration
CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M7 through 10.1.52, from 9.0.83 through 9.0.115; Apache Tomcat Native: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39, from 1.3.0 through 1.3.6, from 2.0.0 through 2.0.13.
Users are recommended to upgrade to version Tomcat Native 1.3.7 or 2.0.14 and Tomcat 11.0.20, 10.1.53 and 9.0.116, which fix the issue.
Bleepingcomputer
SAP fixes critical flaws in NetWeaver and Commerce Cloud
blogs_bleepingcomputer·2026-06-09·CVSS 9.1
CVE-2026-44748 [CRITICAL] SAP fixes critical flaws in NetWeaver and Commerce Cloud
## SAP fixes critical flaws in NetWeaver and Commerce Cloud
## Bill Toulas
SAP has released fixes for 15 vulnerabilities as part of its June 2026 Security Patch package, including four critical-severity flaws affecting SAP NetWeaver and SAP Commerce Cloud.
NetWeaver is SAP's core application platform and middleware stack that provides the foundation for many SAP business applications, including ERP systems, handling functions such as application serving, integration, authentication, user management, and data processing.
Commerce Cloud is an enterprise e-commerce platform (formerly Hybris). It enables organizations to build and manage online stores, digital sales channels, product catalogs, customer accounts, and order management systems for B2B and B2C commerce.
In this month's securi
2026-04-09
Published