QwikSec

Security Database

CVE

CWE

Training

CVE-2026-34487

Published: Apr 9, 2026

Modified: Apr 10, 2026

PUBLISHED

Description

Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clustering component of Apache Tomcat exposed the Kubernetes bearer token. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1.53, from 9.0.13 through 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.

Vendor	Product	Versions
Apache Software Foundation	Apache Tomcat	affected `11.0.0-M1 - <= 11.0.20` affected `10.1.0-M1 - <= 10.1.53` affected `9.0.13 - <= 9.0.116`

Weaknesses (CWE)

References

https://lists.apache.org/thread/4xpkwolpkrj8v5xzp5nyovtlqp3y850h

vendor-advisory

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.