CVE-2026-34486

This repository contains a functional exploit for CVE-2026-34486, demonstrating unauthenticated RCE in Apache Tomcat via a bypass of the EncryptInterceptor in the Tribes clustering component. The exploit uses a CommonsCollections6 gadget chain to achieve remote code execution when an unencrypted payload is sent to the Tribes receiver port.

This repository contains a functional exploit for CVE-2026-34486, an Apache Tomcat EncryptInterceptor bypass vulnerability. The exploit leverages a misplaced super.messageReceived() call in the EncryptInterceptor to bypass decryption and trigger Java deserialization RCE.

This repository contains a functional exploit PoC for CVE-2026-34486, demonstrating a bypass in Apache Tomcat's EncryptInterceptor due to incorrect placement of the super.messageReceived() call outside the try-catch block, leading to deserialization of unencrypted payloads.

This repository provides a functional proof-of-concept for CVE-2026-34486, an unauthenticated RCE vulnerability in Apache Tomcat's Tribes clustering component. The exploit bypasses the EncryptInterceptor's fail-open logic to trigger Java deserialization via a CommonsCollections6 gadget chain, leading to arbitrary command execution.

This repository provides a functional proof-of-concept exploit for CVE-2026-34486, an unauthenticated RCE vulnerability in Apache Tomcat's Tribes clustering component. The exploit bypasses the EncryptInterceptor's fail-open logic to trigger Java deserialization via a CommonsCollections6 gadget chain, leading to arbitrary command execution.

This PoC exploits a regression in Apache Tomcat's EncryptInterceptor where a missing early-return in the decryption error handler allows unencrypted cluster messages to bypass encryption validation. The exploit sends a minimal serialized Java object to the cluster receiver port, demonstrating the auth_bypass.

This repository contains a Python-based scanner for detecting Apache Tomcat Tribes cluster nodes vulnerable to CVE-2026-34486. The script probes targets by constructing and sending Tribes protocol frames to identify nodes that respond with valid acknowledgments, but does not exploit the deserialization RCE vulnerability.

This repository contains a functional exploit for CVE-2026-34486, demonstrating unauthenticated RCE in Apache Tomcat via a deserialization attack exploiting a fail-open bypass in the EncryptInterceptor. The PoC includes a Java gadget generator, a Python script to send the payload, and a Docker setup for testing.

This repository contains a Python script designed to detect Apache Tomcat Tribes cluster nodes by sending crafted Tribes protocol packets and analyzing responses. It does not exploit CVE-2026-34486 but serves as a scanner to identify vulnerable targets.

This repository contains a functional exploit for CVE-2026-34486, targeting Apache Tomcat's Tribes clustering module. The exploit leverages a deserialization vulnerability in the EncryptInterceptor to achieve unauthenticated RCE on port 4000.

This repository contains a functional exploit for CVE-2026-34486, targeting a deserialization vulnerability in Apache Tomcat's Tribes EncryptInterceptor. The PoC crafts a malicious serialized payload and sends it via a custom network packet to achieve remote code execution (RCE).