High · published April 10, 2026
CVSS calls it high at 7.5. It is confirmed in active exploitation. It sits in the 93.8th percentile for exploit probability.
Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor.
This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116.
Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.
| Product | Versions | Fixed in |
|---|---|---|
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| redhat/jboss_web_server | all versions | — |
| redhat/enterprise_linux | all versions | — |
| redhat/enterprise_linux | all versions | — |
| redhat/enterprise_linux | all versions | — |
| redhat/enterprise_linux_els | all versions | — |
| redhat/enterprise_linux_eus | all versions | — |
| redhat/enterprise_linux_tus | all versions | — |
| redhat/enterprise_linux_update_services_for_sap_solutions | all versions | — |
| redhat/enterprise_linux_update_services_for_sap_solutions | all versions | — |
| redhat/enterprise_linux_update_services_for_sap_solutions | all versions | — |
| redhat/enterprise_linux_update_services_for_sap_solutions | all versions | — |