CVE-2026-34487

Fixed in a distro release EPSS <1%CVSS 7.5

Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clustering component of Apache Tomcat exposed the Kubernetes bearer token. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1.53, from 9.0.13 through 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.

Published 2026-04-09 · CVE record · OSV

Products: Apache Software Foundation Apache Tomcat

Fixed upstream

Ecosystem	Package	Fixed in
Maven	org.apache.tomcat.embed:tomcat-embed-core	9.0.117
Maven	org.apache.tomcat.embed:tomcat-embed-core	10.1.54
Maven	org.apache.tomcat.embed:tomcat-embed-core	11.0.21
Maven	org.apache.tomcat:tomcat	9.0.117
Maven	org.apache.tomcat:tomcat	10.1.54
Maven	org.apache.tomcat:tomcat	11.0.21
Maven	org.apache.tomcat:tomcat-tribes	9.0.117
Maven	org.apache.tomcat:tomcat-tribes	10.1.54
Maven	org.apache.tomcat:tomcat-tribes	11.0.21

Distro releases

Release	Package	Fixed in
Chainguard	camunda-8.8	8.8.22-r0
Chainguard	camunda-zeebe-8.6	8.6.39-r0
Chainguard	camunda-zeebe-8.7	8.7.27-r0
Chainguard	camunda-zeebe-8.8	8.8.22-r0
Chainguard	kayenta-2025.0	2025.0.8-r11
Chainguard	kayenta-2025.1	2025.1.6-r9
Chainguard	kayenta-2025.2	2025.2.4-r5
Chainguard	kayenta-2025.4	2025.4.3-r6
Chainguard	kayenta-2026.0	2026.0.2-r6
Chainguard	kayenta-fips-2025.0	2025.0.8-r13
Chainguard	kayenta-fips-2025.1	2025.1.6-r10
Chainguard	kayenta-fips-2025.2	2025.2.4-r6
Chainguard	kayenta-fips-2025.4	2025.4.3-r7
Chainguard	kayenta-fips-2026.0	2026.0.2-r7
Chainguard	nacos	3.2.0-r6
Chainguard	nacos-docker	3.2.0-r2
Chainguard	ontop	5.5.0-r8
Chainguard	ontop-fips	5.5.0-r4
Chainguard	thingsboard-tb-mqtt-transport	4.3.1.1-r11
Chainguard	thingsboard-tb-node	4.3.1.1-r11
Debian 12	tomcat10	10.1.55-1~deb12u1
Debian 12	tomcat9	9.0.70-2
Debian 13	tomcat10	10.1.55-1~deb13u1
Debian 13	tomcat11	11.0.22-1~deb13u1
Debian 13	tomcat9	9.0.70-2
Debian 14	tomcat10	10.1.54-1
Debian 14	tomcat11	11.0.21-1
Debian 14	tomcat9	9.0.70-2
Red Hat Enterprise Linux 8	tomcat	1:9.0.120-1.el8_10
Red Hat Enterprise Linux 8	tomcat-admin-webapps	1:9.0.120-1.el8_10
Red Hat Enterprise Linux 8	tomcat-docs-webapp	1:9.0.120-1.el8_10
Red Hat Enterprise Linux 8	tomcat-el-3.0-api	1:9.0.120-1.el8_10
Red Hat Enterprise Linux 8	tomcat-jsp-2.3-api	1:9.0.120-1.el8_10
Red Hat Enterprise Linux 8	tomcat-lib	1:9.0.120-1.el8_10
Red Hat Enterprise Linux 8	tomcat-servlet-4.0-api	1:9.0.120-1.el8_10
Red Hat Enterprise Linux 8	tomcat-webapps	1:9.0.120-1.el8_10
Red Hat Enterprise Linux 9	tomcat	1:9.0.117-1.el9_8
Red Hat Enterprise Linux 9	tomcat-admin-webapps	1:9.0.117-1.el9_8
Red Hat Enterprise Linux 9	tomcat-docs-webapp	1:9.0.117-1.el9_8
Red Hat Enterprise Linux 9	tomcat-el-3.0-api	1:9.0.117-1.el9_8
Red Hat Enterprise Linux 9	tomcat-jsp-2.3-api	1:9.0.117-1.el9_8
Red Hat Enterprise Linux 9	tomcat-lib	1:9.0.117-1.el9_8
Red Hat Enterprise Linux 9	tomcat-servlet-4.0-api	1:9.0.117-1.el9_8
Red Hat Enterprise Linux 9	tomcat-webapps	1:9.0.117-1.el9_8
Red Hat Enterprise Linux eus 10.0	tomcat9	1:9.0.120-1.el10_0
Red Hat Enterprise Linux eus 10.0	tomcat9-admin-webapps	1:9.0.120-1.el10_0
Red Hat Enterprise Linux eus 10.0	tomcat9-docs-webapp	1:9.0.120-1.el10_0
Red Hat Enterprise Linux eus 10.0	tomcat9-el-3.0-api	1:9.0.120-1.el10_0
Red Hat Enterprise Linux eus 10.0	tomcat9-jsp-2.3-api	1:9.0.120-1.el10_0
Red Hat Enterprise Linux eus 10.0	tomcat9-lib	1:9.0.120-1.el10_0
Red Hat Enterprise Linux eus 10.0	tomcat9-servlet-4.0-api	1:9.0.120-1.el10_0
Red Hat Enterprise Linux eus 10.0	tomcat9-webapps	1:9.0.120-1.el10_0
Red Hat jboss enterprise web server 6.2	jws6-tomcat	0:10.1.49-13.redhat_00011.1.el8jws
Red Hat jboss enterprise web server 6.2	jws6-tomcat	0:10.1.49-13.redhat_00011.1.el9jws
Red Hat jboss enterprise web server 6.2	jws6-tomcat	0:10.1.49-13.redhat_00011.1.el10jws
Red Hat jboss enterprise web server 6.2	jws6-tomcat-admin-webapps	0:10.1.49-13.redhat_00011.1.el8jws
Red Hat jboss enterprise web server 6.2	jws6-tomcat-admin-webapps	0:10.1.49-13.redhat_00011.1.el10jws
Red Hat jboss enterprise web server 6.2	jws6-tomcat-admin-webapps	0:10.1.49-13.redhat_00011.1.el9jws
Red Hat jboss enterprise web server 6.2	jws6-tomcat-docs-webapp	0:10.1.49-13.redhat_00011.1.el9jws
Red Hat jboss enterprise web server 6.2	jws6-tomcat-docs-webapp	0:10.1.49-13.redhat_00011.1.el10jws
Red Hat jboss enterprise web server 6.2	jws6-tomcat-docs-webapp	0:10.1.49-13.redhat_00011.1.el8jws
Red Hat jboss enterprise web server 6.2	jws6-tomcat-el-5.0-api	0:10.1.49-13.redhat_00011.1.el9jws
Red Hat jboss enterprise web server 6.2	jws6-tomcat-el-5.0-api	0:10.1.49-13.redhat_00011.1.el10jws
Red Hat jboss enterprise web server 6.2	jws6-tomcat-el-5.0-api	0:10.1.49-13.redhat_00011.1.el8jws
Red Hat jboss enterprise web server 6.2	jws6-tomcat-javadoc	0:10.1.49-13.redhat_00011.1.el8jws
Red Hat jboss enterprise web server 6.2	jws6-tomcat-javadoc	0:10.1.49-13.redhat_00011.1.el9jws
Red Hat jboss enterprise web server 6.2	jws6-tomcat-javadoc	0:10.1.49-13.redhat_00011.1.el10jws
Red Hat jboss enterprise web server 6.2	jws6-tomcat-jsp-3.1-api	0:10.1.49-13.redhat_00011.1.el8jws
Red Hat jboss enterprise web server 6.2	jws6-tomcat-jsp-3.1-api	0:10.1.49-13.redhat_00011.1.el10jws
Red Hat jboss enterprise web server 6.2	jws6-tomcat-jsp-3.1-api	0:10.1.49-13.redhat_00011.1.el9jws
Red Hat jboss enterprise web server 6.2	jws6-tomcat-lib	0:10.1.49-13.redhat_00011.1.el9jws
Red Hat jboss enterprise web server 6.2	jws6-tomcat-lib	0:10.1.49-13.redhat_00011.1.el8jws
Red Hat jboss enterprise web server 6.2	jws6-tomcat-lib	0:10.1.49-13.redhat_00011.1.el10jws
Red Hat jboss enterprise web server 6.2	jws6-tomcat-selinux	0:10.1.49-13.redhat_00011.1.el9jws
Red Hat jboss enterprise web server 6.2	jws6-tomcat-selinux	0:10.1.49-13.redhat_00011.1.el8jws
Red Hat jboss enterprise web server 6.2	jws6-tomcat-selinux	0:10.1.49-13.redhat_00011.1.el10jws
Red Hat jboss enterprise web server 6.2	jws6-tomcat-servlet-6.0-api	0:10.1.49-13.redhat_00011.1.el10jws
Red Hat jboss enterprise web server 6.2	jws6-tomcat-servlet-6.0-api	0:10.1.49-13.redhat_00011.1.el9jws
Red Hat jboss enterprise web server 6.2	jws6-tomcat-servlet-6.0-api	0:10.1.49-13.redhat_00011.1.el8jws
Red Hat jboss enterprise web server 6.2	jws6-tomcat-webapps	0:10.1.49-13.redhat_00011.1.el10jws
Red Hat jboss enterprise web server 6.2	jws6-tomcat-webapps	0:10.1.49-13.redhat_00011.1.el9jws
Red Hat jboss enterprise web server 6.2	jws6-tomcat-webapps	0:10.1.49-13.redhat_00011.1.el8jws
Red Hat rhel e4s 8.8	tomcat	1:9.0.120-1.el8_8
Red Hat rhel e4s 8.8	tomcat-admin-webapps	1:9.0.120-1.el8_8
Red Hat rhel e4s 8.8	tomcat-docs-webapp	1:9.0.120-1.el8_8
Red Hat rhel e4s 8.8	tomcat-el-3.0-api	1:9.0.120-1.el8_8
Red Hat rhel e4s 8.8	tomcat-jsp-2.3-api	1:9.0.120-1.el8_8
Red Hat rhel e4s 8.8	tomcat-lib	1:9.0.120-1.el8_8
Red Hat rhel e4s 8.8	tomcat-servlet-4.0-api	1:9.0.120-1.el8_8
Red Hat rhel e4s 8.8	tomcat-webapps	1:9.0.120-1.el8_8
Red Hat rhel e4s 9.2	tomcat	1:9.0.120-1.el9_2
Red Hat rhel e4s 9.2	tomcat-admin-webapps	1:9.0.120-1.el9_2
Red Hat rhel e4s 9.2	tomcat-docs-webapp	1:9.0.120-1.el9_2
Red Hat rhel e4s 9.2	tomcat-el-3.0-api	1:9.0.120-1.el9_2
Red Hat rhel e4s 9.2	tomcat-jsp-2.3-api	1:9.0.120-1.el9_2
Red Hat rhel e4s 9.2	tomcat-lib	1:9.0.120-1.el9_2
Red Hat rhel e4s 9.2	tomcat-servlet-4.0-api	1:9.0.120-1.el9_2
Red Hat rhel e4s 9.2	tomcat-webapps	1:9.0.120-1.el9_2
Red Hat rhel e4s 9.4	tomcat	1:9.0.120-1.el9_4
Red Hat rhel e4s 9.4	tomcat-admin-webapps	1:9.0.120-1.el9_4
Red Hat rhel e4s 9.4	tomcat-docs-webapp	1:9.0.120-1.el9_4
Red Hat rhel e4s 9.4	tomcat-el-3.0-api	1:9.0.120-1.el9_4
Red Hat rhel e4s 9.4	tomcat-jsp-2.3-api	1:9.0.120-1.el9_4
Red Hat rhel e4s 9.4	tomcat-lib	1:9.0.120-1.el9_4
Red Hat rhel e4s 9.4	tomcat-servlet-4.0-api	1:9.0.120-1.el9_4
Red Hat rhel e4s 9.4	tomcat-webapps	1:9.0.120-1.el9_4
Red Hat rhel eus 9.6	tomcat	1:9.0.120-1.el9_6
Red Hat rhel eus 9.6	tomcat-admin-webapps	1:9.0.120-1.el9_6
Red Hat rhel eus 9.6	tomcat-docs-webapp	1:9.0.120-1.el9_6
Red Hat rhel eus 9.6	tomcat-el-3.0-api	1:9.0.120-1.el9_6
Red Hat rhel eus 9.6	tomcat-jsp-2.3-api	1:9.0.120-1.el9_6
Red Hat rhel eus 9.6	tomcat-lib	1:9.0.120-1.el9_6
Red Hat rhel eus 9.6	tomcat-servlet-4.0-api	1:9.0.120-1.el9_6
Red Hat rhel eus 9.6	tomcat-webapps	1:9.0.120-1.el9_6
Red Hat rhel tus 8.8	tomcat	1:9.0.120-1.el8_8
Red Hat rhel tus 8.8	tomcat-admin-webapps	1:9.0.120-1.el8_8
Red Hat rhel tus 8.8	tomcat-docs-webapp	1:9.0.120-1.el8_8
Red Hat rhel tus 8.8	tomcat-el-3.0-api	1:9.0.120-1.el8_8
Red Hat rhel tus 8.8	tomcat-jsp-2.3-api	1:9.0.120-1.el8_8
Red Hat rhel tus 8.8	tomcat-lib	1:9.0.120-1.el8_8
Red Hat rhel tus 8.8	tomcat-servlet-4.0-api	1:9.0.120-1.el8_8
Red Hat rhel tus 8.8	tomcat-webapps	1:9.0.120-1.el8_8
Rocky Linux 10	tomcat9	1:9.0.117-1.el10_2
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS	tomcat	9.0.117-150200.105.1
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS	tomcat	9.0.117-150200.105.1
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS	tomcat	9.0.117-150200.105.1
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS	tomcat10	10.1.54-150200.5.64.1
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS	tomcat	9.0.117-150200.105.1
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS	tomcat10	10.1.54-150200.5.64.1
SUSE Linux Enterprise Module for Web and Scripting 15 SP7	tomcat	9.0.117-150200.105.1
SUSE Linux Enterprise Module for Web and Scripting 15 SP7	tomcat10	10.1.54-150200.5.64.1
SUSE Linux Enterprise Module for Web and Scripting 15 SP7	tomcat11	11.0.21-150600.13.18.1
SUSE Linux Enterprise Server 12 SP5-LTSS	tomcat	9.0.117-3.163.2
SUSE Linux Enterprise Server 15 SP4-LTSS	tomcat	9.0.117-150200.105.1
SUSE Linux Enterprise Server 15 SP5-LTSS	tomcat	9.0.117-150200.105.1
SUSE Linux Enterprise Server 15 SP5-LTSS	tomcat10	10.1.54-150200.5.64.1
SUSE Linux Enterprise Server 15 SP6-LTSS	tomcat	9.0.117-150200.105.1
SUSE Linux Enterprise Server 15 SP6-LTSS	tomcat10	10.1.54-150200.5.64.1
SUSE Linux Enterprise Server 15 SP6-LTSS	tomcat11	11.0.21-150600.13.18.1
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5	tomcat	9.0.117-3.163.2
SUSE Linux Enterprise Server for SAP Applications 15 SP4	tomcat	9.0.117-150200.105.1
SUSE Linux Enterprise Server for SAP Applications 15 SP5	tomcat	9.0.117-150200.105.1
SUSE Linux Enterprise Server for SAP Applications 15 SP5	tomcat10	10.1.54-150200.5.64.1
SUSE Linux Enterprise Server for SAP Applications 15 SP6	tomcat	9.0.117-150200.105.1
SUSE Linux Enterprise Server for SAP Applications 15 SP6	tomcat10	10.1.54-150200.5.64.1
SUSE Linux Enterprise Server for SAP Applications 15 SP6	tomcat11	11.0.21-150600.13.18.1
Ubuntu 24.04 LTS	tomcat10	no fix
Ubuntu 24.04 LTS	tomcat9	no fix
Ubuntu 25.10	tomcat10	no fix
Ubuntu 25.10	tomcat11	no fix
Ubuntu 25.10	tomcat9	no fix
Ubuntu 26.04 LTS	tomcat10	no fix
Ubuntu 26.04 LTS	tomcat11	no fix
Ubuntu 26.04 LTS	tomcat9	no fix
Ubuntu Pro 18.04 LTS	tomcat9	no fix
Ubuntu Pro 20.04 LTS	tomcat9	no fix
Ubuntu Pro 22.04 LTS	tomcat9	no fix
Wolfi	thingsboard-tb-mqtt-transport	4.3.1.1-r11
Wolfi	thingsboard-tb-node	4.3.1.1-r11
openSUSE Leap 16.0	tomcat	9.0.117-160000.1.1
openSUSE Leap 16.0	tomcat10	10.1.54-160000.1.1
openSUSE Leap 16.0	tomcat11	11.0.21-160000.1.1
openSUSE Tumbleweed	tomcat	9.0.117-1.1
openSUSE Tumbleweed	tomcat10	10.1.54-1.1
openSUSE Tumbleweed	tomcat11	11.0.21-1.1