CVE-2026-66756 is a critical (CVSS 9.8) improper protection of an alternate path in Apache Tika. It affects 4.0.0-alpha-1 before 4.0.0-beta-1. The Apache announcement ties it to the unpack endpoint of tika-server. Upgrade to 4.0.0-beta-1, or stay on a stable 3.x release if you do not need the alpha.
What's affected
- Product: Apache Tika, specifically org.apache.tika:tika-server.
- Affected versions: from 4.0.0-alpha-1 before 4.0.0-beta-1.
- Fixed version: 4.0.0-beta-1, as recommended by the Apache announcement.
- Weakness: CWE-424 improper protection of alternate path.
- Detail from the announcement subject: the unpack endpoint in tika-server allows configuration with unsecureFeatures set to false.
- Severity: CVSS 3.1 9.8, no privileges and no user interaction.
How to check if you're exposed
Find out whether you run a 4.0 alpha build at all. Many deployments use 3.x and are outside the affected range.
# Maven
mvn dependency:tree | grep tika
# Gradle
gradle dependencies | grep tika
# a running jar
ls -1 | grep tika-server
If you run tika-server as a service, check whether the unpack endpoint is reachable from other hosts, and which network can reach the port. The server is often placed behind other services and forgotten.
What to do now
- Search build files, images and running services for Tika 4.0.0-alpha builds.
- Upgrade to 4.0.0-beta-1 or later if you need the 4.0 line.
- Restrict network access to tika-server so only the services that need it can connect.
- Review how the unpack endpoint is used and whether you need it enabled.
- Read the Apache announcement for any configuration advice.
Why it matters
The announcement gives few details, so I will stay close to what it says. The unpack endpoint of tika-server, which extracts embedded content from files, could be reached in a way that bypassed the safeguard controlled by the unsecureFeatures setting. The weakness class, improper protection of an alternate path, describes a control that exists on the main route but not on another route to the same function.
A document parsing service handles files from outside by design, so whatever protections it has are the main barrier. Alpha releases are not meant for production, and this is a reminder to keep them out of it. The CISA KEV flag is false and no exploitation is reported.
Try it yourself
Whether a library is actually reachable decides how urgent a finding is. This walkthrough shows reachability analysis at work.
Click through it at your own pace, or open it full screen.
Quick check
Does this affect Tika 3.x?
The announcement lists only 4.0.0-alpha-1 before 4.0.0-beta-1. Check the announcement if you use another line.
Where did the details come from?
From the Apache announcement on oss-security. It is short, so check the project's own release notes as well.
Sources
Last reviewed: 19 October 2026.
