CVE-2026-34487

High

Advisory

Published 9 Apr 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.004; 38th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 253; of 17,781 indexed, latest versions
Container images: 207; deployed by those charts
Fix available: 3 of 3; affected packages

Apache Tomcat: Cloud membership for clustering component exposed the Kubernetes bearer token

Carried by container images the latest versions of 253 of 17,781 indexed charts deploy, on 207 images.

Affected package	Affected versions	Fixed in	Images
tomcat-embed-coremaven	9.0.13, 9.0.16, 9.0.21, 9.0.26+63 more	9.0.117, 10.1.54, 11.0.21	206
Apache Tomcatbitnami	9.0.80	9.0.117	1
tomcatbitnami	9.0.80-1	9.0.117	1

OSV records: BIT-tomcat-2026-34487 GHSA-x4m4-345f-5h5g

Charts affected

253 by stars

Chart

Latest

Affected images

Radar Score

webapp-db-javawebapp-db-java-repo

0.1.0

1 of 2 See more

webapp-db-java webapp-db-java-repo 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-34487.

Container image	Digest	Package	Fixed in
arturisimo/webapp-db-java :v2	c95524e90b57	tomcat-embed-core@9.0.56	9.0.117

Open the chart page →

2,566

zahori-processzahori

1.0.1

1 of 1 See more

zahori-process zahori 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-34487.

Container image	Digest	Package	Fixed in
zahoriaut/zahori-process :0.1.13	351f8a220ed7	tomcat-embed-core@10.1.10	10.1.54

Open the chart page →

3,480

zahori-serverzahori

1.0.1

1 of 2 See more

zahori-server zahori 1.0.1

1 of the 2 container images this version deploys carry CVE-2026-34487.

Container image	Digest	Package	Fixed in
zahoriaut/zahori-server :0.1.17	b2de13916f3e	tomcat-embed-core@9.0.71	9.0.117

Open the chart page →

5,846

Container images carrying it

207 by charts deploying them

A fixed version is listed for 3 of the 3 affected packages.

Container image	Digest	Package	Fixed in	Used by
dellcloud/pages :monitor	6ba7b22caacd	tomcat-embed-core@9.0.36	9.0.117	79
apache/shenyu-admin :2.4.2	e8b7c4ddd069	tomcat-embed-core@9.0.29	9.0.117	3
jacobalberty/unifi :v10.0.162	896c0ab82d33	tomcat-embed-core@10.1.48	10.1.54	3
pavanelthepu/todo-api :1.0.2	f47658e3b24c	tomcat-embed-core@9.0.48	9.0.117	3
apache/fineract :1.12.1	a83cf1980609	tomcat-embed-core@10.1.39	10.1.54	2
apacherocketmq/rocketmq-dashboard :2.1.0	ce78506bd6fe	tomcat-embed-core@10.1.40	10.1.54	2
dina1993/airports-api :latest	ac731244aed1	tomcat-embed-core@10.1.7	10.1.54	2
dina1993/airports-consumer :latest	669d146a5e63	tomcat-embed-core@10.1.7	10.1.54	2
dina1993/airports-producer :latest	3d6b0dac1cb4	tomcat-embed-core@10.1.7	10.1.54	2
geoservercloud/geoserver-cloud-rest :1.0-RC3	99540eef78ad	tomcat-embed-core@9.0.37	9.0.117	2
geoservercloud/geoserver-cloud-wcs :1.0-RC3	5c254c53a357	tomcat-embed-core@9.0.37	9.0.117	2
geoservercloud/geoserver-cloud-webui :1.0-RC3	c687b1cbc891	tomcat-embed-core@9.0.37	9.0.117	2
geoservercloud/geoserver-cloud-wfs :1.0-RC3	5288f320cf36	tomcat-embed-core@9.0.37	9.0.117	2
geoservercloud/geoserver-cloud-wms :1.0-RC3	a30a60ac6cd0	tomcat-embed-core@9.0.37	9.0.117	2
inaccel/coral :2.1	8c53744ed70b	tomcat-embed-core@9.0.83	9.0.117	2
nacos/nacos-server :v2.1.0	dcf04549c6d7	tomcat-embed-core@9.0.38	9.0.117	2
piomin/sample-spring-kotlin-microservice :1.1	871f784dd6bc	tomcat-embed-core@9.0.65	9.0.117	2
scorpiobroker/scorpio :RegistrySubscriptionManager_2.1.0	01e11d800459	tomcat-embed-core@9.0.55	9.0.117	2
scorpiobroker/scorpio :eureka-server_2.1.0	3f05a113a4be	tomcat-embed-core@9.0.55	9.0.117	2
scorpiobroker/scorpio :AtContextServer_2.1.0	5073ceef2fa0	tomcat-embed-core@9.0.55	9.0.117	2
scorpiobroker/scorpio :gateway_2.1.0	62dae3dd0eeb	tomcat-embed-core@9.0.55	9.0.117	2
scorpiobroker/scorpio :RegistryManager_2.1.0	a2cfcf0947fd	tomcat-embed-core@9.0.55	9.0.117	2
scorpiobroker/scorpio :QueryManager_2.1.0	b742a53b2803	tomcat-embed-core@9.0.55	9.0.117	2
scorpiobroker/scorpio :HistoryManager_2.1.0	b7fe27a06ff5	tomcat-embed-core@9.0.55	9.0.117	2
scorpiobroker/scorpio :config-server_1.1.0	c46c1517e523	tomcat-embed-core@9.0.26	9.0.117	2
scorpiobroker/scorpio :SubscriptionManager_2.1.0	e08036670d66	tomcat-embed-core@9.0.55	9.0.117	2
scorpiobroker/scorpio :EntityManager_2.1.0	f02e8a429a08	tomcat-embed-core@9.0.55	9.0.117	2
stakater/stakater-nordmart-review :1.0.35	954d2be66e95	tomcat-embed-core@9.0.65	9.0.117	2
2martens/configserver :latest	bf1cdb80239d	tomcat-embed-core@10.1.28	10.1.54	1
2martens/timetable :latest	bd1ba6ab84c9	tomcat-embed-core@10.1.46	10.1.54	1
2martens/wahlrecht :latest	ba2c3040dab0	tomcat-embed-core@10.1.43	10.1.54	1
adityaprasadpathak/myapp :3.0	7e3b9777362c	tomcat-embed-core@10.1.25	10.1.54	1
airsonicadvanced/airsonic-advanced :latest	f7cbafac2806	tomcat-embed-core@9.0.46	9.0.117	1
andrianrf/backoffice-be :latest	6036614803d4	tomcat-embed-core@9.0.75	9.0.117	1
andrianrf/bpjstk-service :latest	46abe878d9d8	tomcat-embed-core@9.0.38	9.0.117	1
andrianrf/bpjstk-simulator :latest	b63fdb51d39d	tomcat-embed-core@9.0.38	9.0.117	1
andrianrf/iso-client :latest	ba560086ce15	tomcat-embed-core@9.0.38	9.0.117	1
andrianrf/iso-server :latest	7da47f525c7d	tomcat-embed-core@9.0.36	9.0.117	1
apache/hertzbeat :1.8.0	75d48a62748f	tomcat-embed-core@10.1.34	10.1.54	1
apache/hertzbeat-collector :1.8.0	a2bab1be574c	tomcat-embed-core@10.1.34	10.1.54	1
apache/ranger :2.7.0	76c176e8a0e4	tomcat-embed-core@9.0.98	9.0.117	1
apache/rocketmq-exporter :0.0.2	c8fb51195444	tomcat-embed-core@9.0.74	9.0.117	1
apacherocketmq/rocketmq-dashboard :1.0.0	24799aff6cf8	tomcat-embed-core@9.0.29	9.0.117	1
apache/shenyu-admin :2.5.1	e2be712fc4f4	tomcat-embed-core@9.0.63	9.0.117	1
aroralalit/student-producer :1.0.0	2a094f597b36	tomcat-embed-core@9.0.75	9.0.117	1
arturisimo/webapp-db-java :v2	c95524e90b57	tomcat-embed-core@9.0.56	9.0.117	1
audig/clamapi :2.1.6	2c3fe34ee430	tomcat-embed-core@9.0.37	9.0.117	1
beastob/url-shortener :1.0.2	99a49885ab33	tomcat-embed-core@9.0.53	9.0.117	1
binhex/arch-nzbhydra2 :3.1.0-1-01	fb8952921ab6	tomcat-embed-core@9.0.36	9.0.117	1
blackducksoftware/blackduck-alert :8.4.0	90cca32de2cc	tomcat-embed-core@10.1.42	10.1.54	1