A missing encryption of sensitive data vulnerability in a widely deployed Java application server cluster component has been added to the federal directory of actively exploited flaws. The bug permits network-adjacent threat actors to bypass pre-shared key encryption routines and intercept sensitive cluster communication streams.
The vulnerability, tracked as CVE-2026-34486 with a CVSS score of 7.5, affects Apache Tomcat versions 11.0.0 through 11.0.20, 10.1.0 through 10.1.53, and 9.0.0 through 9.0.116. The issue involves a flaw inside EncryptInterceptor, a cluster component designed to enforce pre-shared key encryption on messages transmitted between Tomcat cluster nodes. By exploiting the logic error, an attacker positioning themselves on the cluster subnet can bypass encryption checks, read cleartext inter-node messages, and extract session state tokens.
Subverting cluster inter-node encryption undermines multi-server application boundaries. Armed with cleartext session tokens and cluster communication states, threat actors can hijack active user sessions, steal authorization tokens, and execute secondary impersonation attacks against connected enterprise web applications.
– Upgrade Apache Tomcat installations to secure versions 11.0.21, 10.1.54, or 9.0.117 and higher immediately.
– Enforce network-level transport layer security across all Tomcat cluster communication channels using dedicated VLANs.
– Monitor cluster network traffic for unencrypted packet transfers or unauthorized inter-node connection attempts.
– Rotate all session keys and pre-shared cluster secret tokens across active server pools.
Application server cluster security relies on mandatory transport encryption and continuous protocol verification to ensure inter-node messaging pathways remain completely protected from unauthorized network interception. #CodeDefence #Apache #Tomcat #ClusterSecurity #Encryption #SessionHijacking #CISA #KEV #AppSec
/
