Apache Tomcat Security Update – 03 May 2026

The addressed vulnerabilities could allow the attacker to bypass security restrictions, perform request smuggling attacks, obtain sensitive information from server logs, or redirect victims to attacker-controlled sites to perform phishing or other social engineering attacks.

Sample of the addressed vulnerabilities:

1. Apache Tomcat OSCP Checks Authentication Bypass Vulnerability (CVE-2026-29145):

• CVSS: 9.1
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Consequences: Bypass Security

2. Apache Tomcat Kubernetes Bearer Tokens Exposure Vulnerability (CVE-2026-34487):

• CVSS: 7.5
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Consequences: Obtain Information