The Apache Tomcat cloud membership for clustering component incorrectly logs Kubernetes bearer tokens, which are highly sensitive secrets. This results in the token being written to standard log files, exposing privileged credentials and enabling an attacker to gain unauthorized access to the Kubernetes cluster and its resources. The vulnerability aligns with CWE‑532 and CWE‑538, which describe the insertion of sensitive information into logs and unrestricted log file access.

Apache Tomcat versions 9.x (9.0.13‑9.0.116), 10.x (10.1.0‑M1‑10.1.53), and 11.x (11.0.0‑M1‑11.0.20) are affected. Administrators should check whether their installers fall within these ranges, as the exposure applies to the clustering component across all major releases.

The CVSS score of 7.5 classifies the issue as high risk, while the EPSS score of less than 1% indicates a low probability of exploitation, and it is not listed in the CISA KEV catalog. The attack vector is inferred to be local or remote read access to Tomcat log files; an adversary who can read those logs may extract the bearer token. No documented public exploit currently exists, and the issue is resolved by applying the vendor’s patch.