CVE-2026-55276: Apache Tomcat: Logged effective web.xml is incomplete

Synopsis

An always-incorrect control flow vulnerability in Apache Tomcat causes the effective web.xml security configuration to be logged incompletely, omitting special roles and empty authorization constraints. The flaw is reachable over the network with no authentication required and no user interaction needed. Successful exploitation allows an attacker to read sensitive configuration data and tamper with security-relevant application state, achieving both high confidentiality and high integrity impact. A patched-image rebuild at versions 11.0.23, 10.1.56, or 9.0.119 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Tomcat service over the network; no local or physical access is needed.

• AuthenticationNot required

  No account or credential of any privilege level is required to trigger the vulnerability.

• Victim interactionNot required

  Exploitation is fully attacker-driven and does not require any action from a user or administrator.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions or specific memory layout requirements exist.

Blast Radius

• An attacker reads logged web.xml output that silently omits special roles and empty authorization constraints, gaining an accurate picture of which security rules are actually missing from the deployed configuration.
• With knowledge of the true (incomplete) authorization model, an attacker identifies unprotected endpoints or resources and accesses data that should be gated behind role checks.
• An attacker manipulates application behavior or data by targeting endpoints whose empty authorization constraints are invisible in the logged configuration, bypassing expected access controls.