CVE-2026-15554

Name of the Vulnerable Software and Affected Versions Undertow (affected versions not specified)

Description The Undertow AJP listener accepts forged ssl cert and is ssl AJP attributes without requiring shared-secret authentication. This allows an unauthenticated attacker with direct TCP access to port 8009 to bypass CLIENT-CERT authentication by injecting a forged X.509 certificate via the AJP protocol.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.