Listen to this Post
CVE-2026-65182 is an improper access control and incorrect authorization vulnerability residing within Apache Tomcat’s security constraint processing mechanism.
The flaw specifically manifests when web application deployment descriptors in web.xml define security constraints.
In vulnerable versions of Apache Tomcat, if a security constraint for a longer URL path is mistakenly or intentionally specified before a more restrictive constraint for a shorter sub-path, the evaluation logic fails.
Instead of applying the strictest matching constraint found, the container’s constraint matching parser processes elements sequentially and can match the broader rule prematurely.
This ordering discrepancy allows remote, unauthenticated attackers to bypass intended security constraints completely.
Consequently, restricted administrative endpoints, sensitive resources, or private APIs that should require specific authentication roles become publicly accessible.
The root cause stems from CWE-551, involving incorrect behavior order where authorization checks fail to canonicalize and parse hierarchy precedence correctly.
This vulnerability impacts multiple major release branches of Apache Tomcat, including versions 11.0.0 through 11.0.24, 10.1.0 through 10.1.57, 9.0.0 through 9.0.120, and legacy EOL branches like 8.5.x and 7.0.x.
Because no user interaction or specialized privileges are required to launch this attack over the network, it presents a significant threat vector to enterprise web applications.
Administrators often rely on declarative security constraints to secure directories and servlet mappings, making transparent bypasses particularly dangerous.
Security audits that check web.xml configurations frequently miss order-dependent flaws unless explicitly parsed for path specificity.
Attackers exploit this by crafting HTTP requests targeting the hidden sub-paths, leveraging the misordered rules to slip past access controls unnoticed.
DailyCVE Form:
Platform: Apache Tomcat
Version: 9.0.120 and prior
Vulnerability : Security constraint bypass
Severity : Important security flaw
date : August 25 2026
Prediction: Patched in 9.0.121
What Undercode Say:
Here are the analysis details regarding the evaluation order mechanism and container processing logic.
Check web.xml security constraints ordering grep -n "url-pattern" web.xml Test endpoint access before patching curl -I http://localhost:8080/app/admin/sensitive-resource
// Conceptual security constraint processing flaw snippet
public boolean checkConstraint(String path) {
for (SecurityConstraint constraint : constraints) {
if (path.startsWith(constraint.getUrlPattern())) {
return evaluateRole(constraint); // returns early on first match
}
}
return true;
}
Exploit: (Educational Purposes!)
To demonstrate the flaw conceptually, an attacker locates a broader constraint mapping defined before a specific restricted sub-path in web.xml. The attacker sends an HTTP GET request directly to the sub-path URL. Because the parser encounters the broader pattern first during sequential iteration, it evaluates the request against the relaxed rule. The authorization check passes prematurely, granting full HTTP 200 OK access to the restricted resource without validating credentials or roles.
Protection: from this CVE
Upgrade Apache Tomcat immediately to version 9.0.121, 10.1.58, 11.0.25, or later where the constraint evaluation logic is fixed. If immediate upgrading is impossible on end-of-life branches like 8.5.x or 7.0.x, manually reorder the security-constraint elements in web.xml. Ensure that more restrictive, shorter sub-path constraints are placed strictly before broader, longer path constraints. Restart the Tomcat service to apply configuration changes and regularly audit web application access logs.
Impact:
Unauthorized exposure of protected backend resources and administrative endpoints to unauthenticated external users. Potential compromise of data confidentiality and integrity across vulnerable web applications relying on declarative role mapping. No direct impact on server availability or hardware stability, but severe risk of unauthorized privilege escalation and data theft.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
