CVE-2026-34487CWE-532

Apache Tomcat: Cloud membership for clustering component exposed the Kubernetes bearer token

High · published April 9, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
37.9
In the wild
Unconfirmed
What it is

Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clustering component of Apache Tomcat exposed the Kubernetes bearer token.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1.53, from 9.0.13 through 9.0.116.

Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00447 · 37.9th percentile
Weakness
CWE-532 · Insertion of Sensitive Information into Log File
Published
2026-04-09T19:36Z
EPSS history
Timeline
  • 09 APR 19:36Z
    Apache Tomcat: Cloud membership for clustering component exposed the Kubernetes bearer token
    cvelistv5