Received information indicating that the cloud membership module of Apache Tomcat logs the Kubernetes bearer token directly into plain text log files. The vulnerability can lead to disclosure of a credential that grants privileged access to the cluster, potentially enabling further lateral movement or unauthorized resource manipulation. The weakness identified aligns with CWE‑532, the insertion of sensitive information into logs.

Apache Tomcat 11.0.0‑M1 through 11.0.20, Apache Tomcat 10.1.0‑M1 through 10.1.53, and Apache Tomcat 9.0.13 through 9.0.116 are affected. Any deployment of these versions within a Kubernetes environment is at risk until upgraded.

The exploit requires the attacker to have legitimate access to the Tomcat log directory or the ability to read logs sent to a remote syslog server. While the public CVSS score is not provided, the presence of a bearer token in logs represents high confidentiality loss, and the EPSS score is unavailable. The vulnerability is not listed in the CISA KEV catalog, suggesting no known active exploitation yet; however, the severity of potential credential compromise warrants immediate attention.