striga-ai/cve-2026-34486

This repository is a proof of concept for a specific security vulnerability, CVE-2026-34486, found in Apache Tomcat, a widely used Java web server. The bug lives in a component called Tribes, which Tomcat uses to let multiple server instances talk to each other in a cluster. Tribes has an EncryptInterceptor feature meant to encrypt that traffic between servers, but the researchers found a fail open flaw: if an attacker sends unencrypted data instead, the interceptor lets it through rather than rejecting it. Combined with how Tomcat deserializes incoming Java objects, this allows an attacker with network access to the cluster port to run arbitrary code on the server without needing any login credentials. The affected versions are Tomcat 11.0.19 and later, 10.1.53 and later, and 9.0.116 and later. The issue is fixed in versions 11.0.21, 10.1.54, and 9.0.117, so anyone running an affected version should upgrade. The vulnerability was found and reported by a researcher at striga.ai, and the repository links to their full technical writeup for background on how the bug was discovered. To use the repository, you need Docker, Java 21, and Python 3 installed. Running a single script, run.sh, does everything automatically: it builds a Docker image, starts a vulnerable Tomcat 11.0.20 instance with EncryptInterceptor enabled, crafts a Java deserialization gadget chain payload, and sends it unencrypted to the Tribes clustering port. It then checks for a marker file inside the container to confirm that arbitrary code execution succeeded. A cleanup command is provided to remove the Docker container afterward. This project is intended for security researchers, penetration testers, and Tomcat administrators who want to verify whether their own deployments are vulnerable and understand the mechanics of the flaw, not as a tool for attacking systems without authorization.