CVE-2026-53434: Apache Tomcat: Invalid CRL configuration doesn't trigger failure for FFM Connector

Synopsis

This is an authentication bypass vulnerability in Apache Tomcat affecting the FFM (Foreign Function and Memory) connector's handling of Certificate Revocation List (CRL) configuration. When a CRL is configured incorrectly, Tomcat silently ignores the error instead of rejecting the configuration or blocking TLS client connections, meaning revoked certificates are accepted as valid. An attacker over the network, with no credentials required, can authenticate using a certificate that should have been rejected, gaining unauthorized read and write access to protected resources. A patched-image rebuild is available on HarborGuard for environments running affected versions once the upstream fix is confirmed published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Tomcat FFM connector over the network; the service must be exposed on a routable or internet-facing interface.

• AuthenticationNot required

  No credentials are needed; the flaw exists precisely in the layer that is supposed to enforce certificate-based authentication, so an attacker with any certificate (including a revoked one) can proceed without a valid identity check.

• Victim interactionNot required

  No user interaction is required; the attacker connects directly to the Tomcat endpoint and the vulnerability is triggered server-side.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special conditions such as race conditions or precise memory layout.

Blast Radius

• Reads protected application data and session content served by Tomcat, including anything gated behind mutual TLS client authentication.
• Modifies or submits data to application endpoints that were intended to be restricted to holders of valid, non-revoked certificates.
• Bypasses identity-based access controls entirely, allowing a holder of any revoked certificate to impersonate a previously trusted client identity.
• No availability impact is indicated by the CVSS vector; the service itself remains running while the breach occurs.