Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
cve-2026-29145 — Original security research and proof-of-concept for CVE-2026-29145, an Apache Tomcat OCSP authentication bypass vulnerability, including technical analysis and reproduction steps. | Kitploit
Tools/GitHubGitHub/gregk4sec/cve-2026-29145
Vulnerability AnalysisExploitationWeb SecurityAuthentication
GitHubgregk4sec/cve-2026-29145

cve-2026-29145

Original security research and proof-of-concept for CVE-2026-29145, an Apache Tomcat OCSP authentication bypass vulnerability, including technical analysis and reproduction steps.

View Repository
4 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

Type: CVE Discoverer: gregk4sec Research: Original Status: Public

CVE-2026-29145 — OCSP checks sometimes soft-fail even when soft-fail is disabled

Discoverer: gregk4sec (https://github.com/gregk4sec/cve)
Discovery Date: 2026-02-26
Affected Vendor: Apache
Affected Product: Tomcat
Severity: 9.1 CRITICAL
CWE: CWE-287 Improper Authentication Status: Under Review / Fixed / Private / Public ✅

Summary

CLIENT_CERT authentication did not fail OCSP checks as expected for some scenarios when soft fail was disabled.

Technical Analysis

See:

analysis.md

Reproduction Steps

  1. Environment setup
  2. Trigger conditions
  3. Expected vs actual behavior
  4. Screenshots (optional)

Proof of Concept (PoC)

PoC files are located in:

root@kitploit:~
./poc/

Note: Some PoC content may be redacted or published later depending on disclosure requirements.

Disclosure Timeline

See: timeline.md

Vendor Response

See: ./vendor-response/

References

  • CVE Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-29145
  • Vendor Advisory: https://lists.apache.org/thread/yz5fxmhd2j43wgqykssdo7kltws57jfz
  • Security Bulletin: https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.20
  • Related Research:

Attribution

This vulnerability is an original discovery by gregk4sec (https://github.com/gregk4sec/cve).
Repository: https://github.com/gregk4sec/cve

Download Tool