CVE-2026-34487

{
  "id": "CVE-2026-34487",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-09T20:16:25.203",
  "lastModified": "2026-10-26T21:10:00.170",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clustering component of Apache Tomcat exposed the Kubernetes bearer token.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1.53, from 9.0.13 through 9.0.116.\n\nUsers are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue."
    },
    {
      "lang": "es",
      "value": "La vulnerabilidad de Inserción de Información Sensible en Archivo de Registro en el componente de membresía en la nube para clustering de Apache Tomcat expuso el token portador de Kubernetes.\n\nEste problema afecta a Apache Tomcat: desde 11.0.0-M1 hasta 11.0.20, desde 10.1.0-M1 hasta 10.1.53, desde 9.0.13 hasta 9.0.116.\n\nSe recomienda a los usuarios actualizar a la versión 11.0.21, 10.1.54 o 9.0.117, que solucionan el problema."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache Tomcat",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "11.0.0-M1",
              "lessThanOrEqual": "11.0.20",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "10.1.0-M1",
              "lessThanOrEqual": "10.1.53",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "9.0.13",
              "lessThanOrEqual": "9.0.116",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-10T17:47:28.920468Z",
          "id": "CVE-2026-34487",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-532"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "9.0.13",
              "versionEndExcluding": "9.0.117",
              "matchCriteriaId": "58E041DD-A50A-4A27-93BB-C2302FF96636"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "10.1.0",
              "versionEndExcluding": "10.1.54",
              "matchCriteriaId": "EEF3315E-7D6A-447E-B9A4-896758B82EB1"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "11.0.0",
              "versionEndExcluding": "11.0.21",
              "matchCriteriaId": "D0155D8E-9EA1-43EA-B368-6418B526D8B5"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://lists.apache.org/thread/4xpkwolpkrj8v5xzp5nyovtlqp3y850h",
      "source": "[email protected]",
      "tags": [
        "Mailing List",
        "Vendor Advisory"
      ]
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2026/04/09/28",
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ]
    }
  ]
}