GitHub Advisoryadvisory · Maven

GHSA-x4m4-345f-5h5g Apache Tomcat vulnerable to Insertion of Sensitive Information into Log File

HIGH Published 2026-04-09 Modified 2026-08-12 Official page ↗
Aliases
CVE-2026-34487
Ecosystem
Maven
Packages
org.apache.tomcat:tomcat-tribes, org.apache.tomcat:tomcat, org.apache.tomcat.embed:tomcat-embed-core
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-532
Reviewed
2026-04-10

Affected packages

• Maven org.apache.tomcat:tomcat-tribes: >= 9.0.13, < 9.0.117 → fixed in 9.0.117 • Maven org.apache.tomcat:tomcat-tribes: >= 10.1.0-M1, < 10.1.54 → fixed in 10.1.54 • Maven org.apache.tomcat:tomcat-tribes: >= 11.0.0-M1, < 11.0.21 → fixed in 11.0.21 • Maven org.apache.tomcat:tomcat: >= 9.0.13, < 9.0.117 → fixed in 9.0.117 • Maven org.apache.tomcat:tomcat: >= 10.1.0-M1, < 10.1.54 → fixed in 10.1.54 • Maven org.apache.tomcat:tomcat: >= 11.0.0-M1, < 11.0.21 → fixed in 11.0.21 • Maven org.apache.tomcat.embed:tomcat-embed-core: >= 9.0.13, < 9.0.117 → fixed in 9.0.117 • Maven org.apache.tomcat.embed:tomcat-embed-core: >= 10.1.0-M1, < 10.1.54 → fixed in 10.1.54 • Maven org.apache.tomcat.embed:tomcat-embed-core: >= 11.0.0-M1, < 11.0.21 → fixed in 11.0.21

Description

Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clustering component of Apache Tomcat exposed the Kubernetes bearer token. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1.53, from 9.0.13 through 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.

Related

Alias · CVE (1)

  • CVE-2026-34487 Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clustering component of Apache Tomcat exposed… vulnerability

Weakness · CWE (1)

  • CWE-532 Insertion of Sensitive Information into Log File weakness

References