CVE-2026-34487

Description

Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clustering component of Apache Tomcat exposed the Kubernetes bearer token. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1.53, from 9.0.13 through 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.

CVSS Details

CVSS Score

7.5

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Configurations (Affected Products)

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* - VULNERABLE

Apache Tomcat 11.0.0-M1 至 11.0.20

Apache Tomcat 10.1.0-M1 至 10.1.53

Apache Tomcat 9.0.13 至 9.0.116

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

import re

def check_log_for_token(log_file_path):
    # Regex pattern to identify Kubernetes Bearer Token
    token_pattern = r'"authorization".*"Bearer\s+([A-Za-z0-9\._-]+)"'
    print(f'[*] Analyzing log file: {log_file_path}')
    
    try:
        with open(log_file_path, 'r', encoding='utf-8', errors='ignore') as f:
            for line_num, line in enumerate(f, 1):
                if 'cloud membership' in line.lower():
                    match = re.search(token_pattern, line)
                    if match:
                        print(f'[!] Vulnerability Confirmed at line {line_num}')
                        print(f'[!] Exposed Token: {match.group(1)}')
                        return True
        print('[-] No sensitive information found in the specified context.')
        return False
    except FileNotFoundError:
        print('[-] Error: Log file not found.')
        return False

# Execute check
# check_log_for_token('/usr/local/tomcat/logs/catalina.out')

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-34487
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-34487
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-34487/
[4] VulDB https://vuldb.com/cve/CVE-2026-34487
[5] https://lists.apache.org/thread/4xpkwolpkrj8v5xzp5nyovtlqp3y850h
[6] http://www.openwall.com/lists/oss-security/2026/04/09/28

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-34487", "sourceIdentifier": "[email protected]", "published": "2026-04-09T20:16:25.203", "lastModified": "2026-04-14T12:44:45.573", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clustering component of Apache Tomcat exposed the Kubernetes bearer token.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1.53, from 9.0.13 through 9.0.116.\n\nUsers are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-532"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.0.13", "versionEndExcluding": "9.0.117", "matchCriteriaId": "58E041DD-A50A-4A27-93BB-C2302FF96636"}, {"vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "versionStartIncluding": "10.1.0", "versionEndExcluding": "10.1.54", "matchCriteriaId": "EEF3315E-7D6A-447E-B9A4-896758B82EB1"}, {"vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "versionStartIncluding": "11.0.0", "versionEndExcluding": "11.0.21", "matchCriteriaId": "D0155D8E-9EA1-43EA-B368-6418B526D8B5"}]}]}], "references": [{"url": "https://lists.apache.org/thread/4xpkwolpkrj8v5xzp5nyovtlqp3y850h", "source": "[email protected]", "tags": ["Mailing List", "Vendor Advisory"]}, {"url": "http://www.openwall.com/lists/oss-security/2026/04/09/28", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"]}]}}