CVE-2026-25854
Last modified
CVE-2026-25854 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. Occasional URL redirection to untrusted Site ('Open Redirect') vulnerability in Apache Tomcat via the LoadBalancerDrainingValve. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M23 through 9.0.115, from 8.5.30 through 8.5.100. Other, unsupported versions may also be affected Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.. EPSS estimates a 0.53% chance of exploitation in the next 30 days.
Description
Occasional URL redirection to untrusted Site ('Open Redirect') vulnerability in Apache Tomcat via the LoadBalancerDrainingValve. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M23 through 9.0.115, from 8.5.30 through 8.5.100. Other, unsupported versions may also be affected Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Apache | Tomcat | >= 9.0.1, < 9.0.116 | — |
| Apache | Tomcat | >= 10.1.0, < 10.1.53 | — |
| Apache | Tomcat | >= 11.0.0, < 11.0.20 | — |
| Apache | Tomcat | 9.0.0 | Milestone23 |
References
- https://lists.apache.org/thread/ghct3b6o74bp2vm7q875s1zh0dqrz3h0Mailing List, Vendor Advisory
- http://www.openwall.com/lists/oss-security/2026/04/09/21Mailing List, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-25854?
How severe is CVE-2026-25854?
How do I fix CVE-2026-25854?
How Strix Helps
- One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-25846In JetBrains YouTrack before 2025.3.119033 access tokens cou…6.5
- CVE-2026-25847In JetBrains PyCharm before 2025.3.2 a DOM-based XSS on Jupy…6.1
- CVE-2026-25848In JetBrains Hub before 2025.3.119807 authentication bypass …9.8
- CVE-2026-25850in OpenHarmony v6.0 and prior versions allow a local attacke…5.5
- CVE-2026-25851WebSocket endpoints lack proper authentication mechanisms, e…9.8
- CVE-2026-25852Local privilege escalation due to DLL hijacking vulnerabilit…6.7
- CVE-2026-25855OpenBullet2 through version 0.3.2 contains a remote code exe…8.8
- CVE-2026-25856OpenBullet2 through version 0.3.2 contains an authenticated …8.8
- CVE-2026-25857Tenda G300-F router firmware version 16.01.14.2 and prior co…8.8
- CVE-2026-25858macrozheng mall version 1.0.3 and prior contains an authenti…9.3
- CVE-2026-25859Wekan versions prior to 8.20 allow non-administrative users …8.8
- CVE-2026-2586An authenticated Remote Code Execution (RCE) vulnerability w…9.1
Are you affected by CVE-2026-25854?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST