Fail Open, Game Over: Turning a One-LineTomcat Fix into Unauthenticated RCE

A flaw in Apache Tomcat Tribes clustering allows attackers to send crafted cluster messages that bypass authentication and trigger unsafe deserialization, leading…