CVE-2026-76183: Apache Tomcat: Bypass of security constraints for WebSocket endpoints

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-23 · updated 2026-09-30
Weakness: CWE-289

Description

Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints for any WebSocket endpoint to be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following versions were EOS at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.43 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.

Summary

CVE-2026-76183 is an authentication bypass by alternate name in Apache Tomcat that lets attackers circumvent security constraints configured for any WebSocket endpoint. With a CVSS score of 9.8, this is critical: unauthenticated access to protected WebSocket resources may be possible. Affected versions are 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, and 9.0.0.M1 through 9.0.121; end-of-life versions 8.5.0 through 8.5.100 and 7.0.43 through 7.0.109 are also known to be affected. There is no evidence of active exploitation (not in CISA KEV, SSVC exploitation: none, EPSS 0.6%). Upgrade to 11.0.26, 10.1.60, or 9.0.122 to fix the issue; unsupported branches should be migrated to a supported release.

تُعدّ CVE-2026-76183 ثغرة تجاوز للمصادقة بأسلوب Alternate Name في Apache Tomcat، وتتيح للمهاجم تجاوز قيود الأمان المطبّقة على أي نقطة نهاية WebSocket. وبتقييم CVSS يبلغ 9.8 فإن الخطورة حرجة، إذ قد يصبح الوصول غير الموثّق إلى موارد WebSocket المحمية ممكنًا. تشمل الإصدارات المتأثرة 11.0.0-M1 حتى 11.0.25، و10.1.0-M1 حتى 10.1.59، و9.0.0.M1 حتى 9.0.121، كما تتأثر الإصدارات المنتهية الدعم 8.5.0 حتى 8.5.100 و7.0.43 حتى 7.0.109. لا توجد أدلة على استغلال نشط (ليست في CISA KEV، وتقييم SSVC للاستغلال: none، واحتمال EPSS خلال 30 يومًا 0.6%). يُنصح بالترقية إلى 11.0.26 أو 10.1.60 أو 9.0.122 لإصلاح المشكلة، مع ترحيل الفروع غير المدعومة إلى إصدار مدعوم.

Affected products

Apache Tomcat: from 11.0.0-M1 through 11.0.25; from 10.1.0-M1 through 10.1.59; from 9.0.0.M1 through 9.0.121; from 8.5.0 through 8.5.100; from 7.0.43 through 7.0.109

References

Get alerted when CVE-2026-76183 or the next vulnerability affects your stack