erroneo.us
Search all guides⌘K

Digest · Thursday

Security digest: April 9, 2026

1 editorial brief and 3 critical advisories.

All digests · RSS · Markdown

Take stock

  • Check exposure: Tomcat CVE-2026-34486: Cluster EncryptInterceptor Bypass. Anyone running Tomcat 11.0.20, 10.1.53 or 9.0.116 with a <Cluster> element and the EncryptInterceptor configured, especially where the Tribes receiver port (4000-4100 by default) is reachable beyond the cluster nodes.
  • crates.io (Rust): 1 critical advisory (wasmtime). Check with cargo audit.
  • PyPI: 1 critical advisory (apache-airflow). Check with pip-audit (or: pip show <package>).
  • Maven: 1 critical advisory (org.apache.tomcat:tomcat, org.apache.tomcat:tomcat-coyote-ffm). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId>.
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Check exposure

· Vulnerability · CVE-2026-34486

Tomcat CVE-2026-34486: Cluster EncryptInterceptor Bypass

Exploited, but only against three specific Tomcat releases running session-replication clustering with the EncryptInterceptor and a reachable cluster port; check those three things today, and most Tomcat users will find they are not exposed.

Must act: Anyone running Tomcat 11.0.20, 10.1.53 or 9.0.116 with a <Cluster> element and the EncryptInterceptor configured, especially where the Tribes receiver port (4000-4100 by default) is reachable beyond the cluster nodes.

Can relax: Standalone, non-clustered Tomcat (the large majority), clusters that do not use the EncryptInterceptor, every other Tomcat release, and Tomcat 8.5, which is not affected.

  1. Check the version on every Tomcat node (bin/version.sh) and look for exactly 11.0.20, 10.1.53 or 9.0.116.
  2. Check conf/server.xml for a <Cluster> element and an EncryptInterceptor; if neither is present, this CVE does not apply.
  3. Upgrade affected nodes to the current release on their branch (11.0.27, 10.1.61 or 9.0.123), not just the minimum fix.

Read the brief →

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 3

GitHub-reviewed advisories rated critical, published this day (Pacific time).

Maven 1

Check: mvn dependency:tree -Dincludes=<groupId>:<artifactId>

PyPI 1

Check: pip-audit (or: pip show <package>)

crates.io (Rust) 1

Check: cargo audit