CVE-2026-29145

CVE-2026-29145 is a critical authentication bypass vulnerability in Apache Tomcat and Tomcat Native where CLIENT_CERT authentication fails to properly validate certificates when soft fail is disabled. The vulnerability affects multiple versions: Tomcat versions 9.0.83-9.0.115, 10.1.0-M7-10.1.52, and 11.0.0-M1-11.0.18, along with corresponding Tomcat Native releases. Patches are available in Tomcat 9.0.116, 10.1.53, 11.0.20 and Tomcat Native 1.3.7, 2.0.14, and later versions. The vulnerability carries a CVSS score of 9.1 (Critical) with a network-based attack vector requiring no authentication or user interaction, indicating high exploitability. The impact includes both confidentiality and integrity compromise, though availability is not affected. This severity rating reflects the authentication mechanism's fundamental role in protecting sensitive applications. The vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities catalog, and there is no evidence of active exploitation in the wild. The EPSS score of 0.0012 indicates low current exploitation probability relative to other vulnerabilities, and the vulnerability remains inactive on threat intelligence hot lists. However, organizations running affected Tomcat versions should prioritize patching due to the critical nature of authentication bypass vulnerabilities.