Tomcat WebSocket lock can be walked around — check yours this week

Live consoles, trading UIs, and admin tools often treat a Tomcat security constraint as the real lock. This bug says the lock can fail — so inventory every Tomcat instance this week, not next change window.

“We set a security constraint” is not the same as “nobody unauthenticated can connect.”

If your app puts auth in front of a WebSocket endpoint and trusts Tomcat’s security constraints to enforce it, read the September 23 advisory twice. Attackers can walk around the constraint with an alternate endpoint name.

What happened

On September 23, 2026, Apache’s Mark Thomas disclosed CVE-2026-76183: an authentication bypass by alternate name that lets an attacker evade security constraints configured for any WebSocket endpoint. Severity is rated important.

Affected branches include Tomcat 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, and 9.0.0.M1 through 9.0.121. End-of-support 8.5.x and 7.0.x (from 7.0.43) are also known affected. Fixed builds: 11.0.26, 10.1.60, 9.0.122. Unsupported lines must migrate.

Why it matters

WebSocket has become the live channel for consoles, collaboration, trading UIs, IoT gateways, and admin tools. Teams often lock HTTP routes carefully and assume the matching WS endpoint inherits the same constraint. This bug says that assumption can fail via an alternate name — so “we set a security constraint” is not the same as “nobody unauthenticated can connect.”

Tomcat’s installed base across enterprises and cloud images makes this a same-week inventory problem even without a public mass-exploit report yet.

What to do first

• Inventory every Tomcat 9/10/11 (and lingering 8.5/7) instance — app servers, embedded Tomcat, vendor appliances that ship it.
• Upgrade to 11.0.26, 10.1.60, or 9.0.122 immediately; schedule migrations off EOS 8.5/7.
• List WebSocket endpoints that rely on container security constraints for authz; treat them as exposed until patched.
• Put authenticating reverse proxies / API gateways in front of WS where architecture allows, as defense in depth — not a substitute for the upgrade.
• Watch access logs for unexpected WS upgrade requests to alternate endpoint paths around constrained resources.

Forward this — If you own Tomcat app servers or embedded Tomcat: upgrade to 11.0.26 / 10.1.60 / 9.0.122 this week and list every WebSocket endpoint that relies on a security constraint.

Details

• CVE: CVE-2026-76183 — Authentication Bypass by Alternate Name (WebSocket security constraints)
• Affected: Tomcat 11.0.0-M1–11.0.25; 10.1.0-M1–10.1.59; 9.0.0.M1–9.0.121; EOS 8.5.0–8.5.100; 7.0.43–7.0.109
• Fixed: 11.0.26, 10.1.60, 9.0.122
• Disclosed: 2026-09-23 (oss-security)

Hunt / verify

• Confirm catalina.jar / release version strings match a fixed build.
• Enumerate <websocket> / @ServerEndpoint mappings and matching web.xml security constraints.
• Review proxy logs for WS upgrades that bypass expected auth middleware.

Slack paste: Inventory Tomcat 9/10/11 (+ EOS 8.5/7); confirm fixed builds 11.0.26 / 10.1.60 / 9.0.122; list WS endpoints behind security constraints.

Sources

• https://www.openwall.com/lists/oss-security/2026/09/23/21
• https://tomcat.apache.org/
• https://www.cve.org/CVERecord?id=CVE-2026-76183

George Bailey

George Bailey is a cybersecurity researcher and writer at CyberExperts, covering cyber threats, AI, cloud security, vulnerabilities, and defensive strategies. His goal is to help security professionals quickly understand what matters most and how it impacts their organizations.