CVE-2026-15554
HighCVSS 7.4Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
The Undertow AJP listener honors forged ssl_cert and is_ssl AJP attributes without requiring any shared-secret authentication. This enables an unauthenticated attacker with direct TCP access to port 8009 to bypass CLIENT-CERT authentication by injecting a forged X.509 certificate via the AJP protocol.
Risk Assessment
Risk of bypassing client authentication and unauthorized access to applications, potentially leading to security breaches.
Recommendation
Disable the AJP listener if not needed, or apply vendor patches to require shared-secret authentication and validate AJP attributes.
Original NVD description (English source)
the Undertow AJP listener honours forged ssl_cert and is_ssl AJP attributes without requiring any shared-secret authentication. This enables an unauthenticated attacker with direct TCP access to port 8009 to bypass CLIENT-CERT authentication by injecting a forged X.509 certificate via the AJP protocol.