Undertow AJP Authentication Bypass via CVE-2026-15554

CVE-2026-15554 is a critical authentication bypass vulnerability affecting the AJP (Apache Jserv Protocol) listener within Red Hat's Undertow web server. The flaw arises because the listener honors the 'ssl_cert' and 'is_ssl' attributes provided within an incoming AJP request packet without requiring a pre-shared secret or cryptographic validation.

An unauthenticated attacker who can establish a direct TCP connection to the AJP port (default 8009) can inject a forged X.509 certificate into these headers. Because the server trusts these forged attributes, it incorrectly assumes the connection is secured via a valid client certificate, allowing the attacker to bypass CLIENT-CERT authentication requirements. This is particularly dangerous in environments where internal or management interfaces rely on AJP-based mutual TLS for access control. Defenders should prioritize limiting access to port 8009 to trusted, internal-only infrastructure components such as reverse proxies.

Impact

Successful exploitation allows unauthenticated attackers to bypass CLIENT-CERT authentication, potentially granting unauthorized access to administrative or restricted application endpoints. This vulnerability exposes services relying on certificate-based identity verification, which could lead to unauthorized data access or service manipulation within affected Red Hat Undertow deployments. The CVSS base score of 7.4 reflects the high impact on confidentiality and integrity for exposed application components.

Recommendation

• Restrict network access to the AJP listener (default port 8009) to only authorized, trusted reverse proxy IP addresses.
• Patch affected Undertow versions immediately upon vendor release.
• Audit network egress and ingress for traffic targeting TCP port 8009 to identify unauthorized sources or unexpected AJP request patterns.