Plain Text Password Vulnerability in Tomcat User Database

CVE-2026-111248

What is CVE-2026-111248?

The Jakarta Security identity store leverages the Tomcat user database but is vulnerable to authentication bypass due to improper password handling practices. The system compares plaintext passwords with stored values and disregards the configured credential handler, creating a significant security gap. An attacker possessing a stored digest password—which may originate from leaked backup files—can gain unauthorized access. Users are advised to upgrade their installations to Tomcat versions 10.3.0 or 11.0.0-M2 to remediate the vulnerability.

References