Tomcat’s EncryptInterceptor, meant to protect cluster traffic, can be bypassed, letting an attacker read sensitive data that should have been encrypted, no credentials needed.