Sensitive Information Exposure in Apache Tomcat Clustering Component
CVE-2026-34487

Currently unrated

Key Information:

Vendor

Apache
Status
Apache Tomcat
Vendor
CVE Published:
9 April 2026

What is CVE-2026-34487?

The clustering component of Apache Tomcat contains a vulnerability that results in the exposure of the Kubernetes bearer token in log files. This issue impacts various versions of the software, allowing sensitive information to be inadvertently captured and logged. Users are urged to update to the latest versions to prevent potential exploitation and ensure secure handling of Kubernetes tokens.

Affected Version(s)

Apache Tomcat 11.0.0-M1 <= 11.0.20

Apache Tomcat 10.1.0-M1 <= 10.1.53

Apache Tomcat 9.0.13 <= 9.0.116

References

https://lists.apache.org/thread/4xpkwolpkrj8v5xzp5nyovtlq...
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Bartlomiej Dmitruk, striga.ai
.