Search
Find a vulnerability
Search criteria
39 vulnerabilities found for Apache TomEE by Apache Software Foundation
CVE-2026-86336 (GCVE-0-2026-86336)
Vulnerability from cvelistv5 – Published: 2026-11-10 15:38 – Updated: 2026-11-10 15:38
VLAI
EPSS
VEX
Title
Apache TomEE: EJB method authorization is silently skipped on JDK 21+
Summary
Apache TomEE running on JDK 21 or later skips EJB method authorization checks, allowing callers to invoke EJB methods without the configured access restrictions being enforced. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
Severity
No CVSS data available.
CWE
- CWE-862 - Missing Authorization
Assigner
apache
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://lists.apache.org/thread/tv0407xmnpy4qctqm… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache TomEE |
Affected:
10.1.1 , < 10.3.0
(semver)
Affected: 11.0.0-M1 , < 11.0.0-M2 (semver) |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.tomee:openejb-core",
"packageURL": "pkg:maven/org.apache.tomee/openejb-core",
"product": "Apache TomEE",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "10.3.0",
"status": "affected",
"version": "10.1.1",
"versionType": "semver"
},
{
"lessThan": "11.0.0-M2",
"status": "affected",
"version": "11.0.0-M1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "The Apache Software Foundation"
},
{
"lang": "en",
"type": "tool",
"value": "Claude Security"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Markus Jung"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Apache TomEE running on JDK 21 or later skips EJB method authorization checks, allowing callers to invoke EJB methods without the configured access restrictions being enforced. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."
}
],
"value": "Apache TomEE running on JDK 21 or later skips EJB method authorization checks, allowing callers to invoke EJB methods without the configured access restrictions being enforced. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "important"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T15:38:27.655Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/tv0407xmnpy4qctqm9nzx56lgjln2t4j"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Apache TomEE: EJB method authorization is silently skipped on JDK 21+",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-86336",
"datePublished": "2026-11-10T15:38:27.655Z",
"dateReserved": "2026-09-07T08:15:22.131Z",
"dateUpdated": "2026-11-10T15:38:27.655Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86531 (GCVE-0-2026-86531)
Vulnerability from cvelistv5 – Published: 2026-11-10 15:37 – Updated: 2026-11-10 15:37
VLAI
EPSS
VEX
Title
Apache TomEE: DoS via unbounded request body and multipart handling in embedded HTTP server
Summary
The embedded OpenEJB HTTP server does not limit the size of incoming request bodies or of multipart requests, and does not remove the temporary files it creates for multipart parts. A remote unauthenticated attacker can cause excessive memory or disk usage, leading to denial of service. Deployments using the Tomcat connectors are not affected. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions.
Severity
No CVSS data available.
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
apache
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://lists.apache.org/thread/cm1vdbx03ctl607nr… | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache TomEE |
Affected:
4.0.0-beta-1 , ≤ 4.7.5
(semver)
|
|
| Apache Software Foundation | Apache TomEE |
Affected:
7.0.0-M1 , < 10.0.0-M1
(semver)
Affected: 10.0.0-M1 , ≤ 10.2.0 (semver) Affected: 11.0.0-M1 (semver) |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.openejb:openejb-http",
"packageURL": "pkg:maven/org.apache.openejb/openejb-http",
"product": "Apache TomEE",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "4.7.5",
"status": "affected",
"version": "4.0.0-beta-1",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.tomee:openejb-http",
"packageURL": "pkg:maven/org.apache.tomee/openejb-http",
"product": "Apache TomEE",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "10.0.0-M1",
"status": "affected",
"version": "7.0.0-M1",
"versionType": "semver"
},
{
"lessThanOrEqual": "10.2.0",
"status": "affected",
"version": "10.0.0-M1",
"versionType": "semver"
},
{
"status": "affected",
"version": "11.0.0-M1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "The Apache Software Foundation"
},
{
"lang": "en",
"type": "tool",
"value": "Claude Security"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Markus Jung"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The embedded OpenEJB HTTP server does not limit the size of incoming request bodies or of multipart requests, and does not remove the temporary files it creates for multipart parts. A remote unauthenticated attacker can cause excessive memory or disk usage, leading to denial of service. Deployments using the Tomcat connectors are not affected. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions."
}
],
"value": "The embedded OpenEJB HTTP server does not limit the size of incoming request bodies or of multipart requests, and does not remove the temporary files it creates for multipart parts. A remote unauthenticated attacker can cause excessive memory or disk usage, leading to denial of service. Deployments using the Tomcat connectors are not affected. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T15:37:39.782Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/cm1vdbx03ctl607nrrkdqyshwjscpd2y"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Apache TomEE: DoS via unbounded request body and multipart handling in embedded HTTP server",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-86531",
"datePublished": "2026-11-10T15:37:39.782Z",
"dateReserved": "2026-09-07T19:31:49.827Z",
"dateUpdated": "2026-11-10T15:37:39.782Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-87758 (GCVE-0-2026-87758)
Vulnerability from cvelistv5 – Published: 2026-11-10 15:37 – Updated: 2026-11-10 15:37
VLAI
EPSS
VEX
Title
Apache TomEE: Missing TLS hostname verification in ejbds client connections
Summary
The remote EJB client does not verify that the hostname of the server it connects to matches the server's TLS certificate. An attacker able to intercept network traffic between an EJB client and server can impersonate the server and read or modify the traffic, including credentials and invocation data. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
Severity
No CVSS data available.
CWE
- CWE-297 - Improper Validation of Certificate with Host Mismatch
Assigner
apache
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://lists.apache.org/thread/nzy4n8rmv4zl5wzdz… | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache TomEE |
Affected:
4.0.0-beta-1 , ≤ 4.7.5
(semver)
|
|
| Apache Software Foundation | Apache TomEE |
Affected:
7.0.0-M1 , < 10.0.0-M1
(semver)
Affected: 10.0.0-M1 , < 10.3.0 (semver) Affected: 11.0.0-M1 , < 11.0.0-M2 (semver) |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.openejb:openejb-client",
"packageURL": "pkg:maven/org.apache.openejb/openejb-client",
"product": "Apache TomEE",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "4.7.5",
"status": "affected",
"version": "4.0.0-beta-1",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.tomee:openejb-client",
"packageURL": "pkg:maven/org.apache.tomee/openejb-client",
"product": "Apache TomEE",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "10.0.0-M1",
"status": "affected",
"version": "7.0.0-M1",
"versionType": "semver"
},
{
"lessThan": "10.3.0",
"status": "affected",
"version": "10.0.0-M1",
"versionType": "semver"
},
{
"lessThan": "11.0.0-M2",
"status": "affected",
"version": "11.0.0-M1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "The Apache Software Foundation"
},
{
"lang": "en",
"type": "tool",
"value": "Claude Security"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Markus Jung"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The remote EJB client does not verify that the hostname of the server it connects to matches the server\u0027s TLS certificate. An attacker able to intercept network traffic between an EJB client and server can impersonate the server and read or modify the traffic, including credentials and invocation data. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."
}
],
"value": "The remote EJB client does not verify that the hostname of the server it connects to matches the server\u0027s TLS certificate. An attacker able to intercept network traffic between an EJB client and server can impersonate the server and read or modify the traffic, including credentials and invocation data. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-297",
"description": "CWE-297 Improper Validation of Certificate with Host Mismatch",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T15:37:08.193Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/nzy4n8rmv4zl5wzdz0v0kwrj62tjrd7z"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Apache TomEE: Missing TLS hostname verification in ejbds client connections",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-87758",
"datePublished": "2026-11-10T15:37:08.193Z",
"dateReserved": "2026-09-09T07:17:54.309Z",
"dateUpdated": "2026-11-10T15:37:08.193Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97849 (GCVE-0-2026-97849)
Vulnerability from cvelistv5 – Published: 2026-11-10 15:36 – Updated: 2026-11-10 15:36
VLAI
EPSS
VEX
Title
Apache TomEE: Derby network service listens on all interfaces
Summary
The embedded Derby network service ignores its configured bind address and listens on all network interfaces. When the service is enabled, a remote attacker with network access can connect to the database server and read or modify data. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
Severity
No CVSS data available.
CWE
- CWE-1327 - Binding to an Unrestricted IP Address
Assigner
apache
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://lists.apache.org/thread/20fl5wnn3slxs0tq0… | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache TomEE |
Affected:
4.0.0-beta-1 , ≤ 4.7.5
(semver)
|
|
| Apache Software Foundation | Apache TomEE |
Affected:
7.0.0-M1 , < 10.0.0-M1
(semver)
Affected: 10.0.0-M1 , < 10.3.0 (semver) Affected: 11.0.0-M1 , < 11.0.0-M2 (semver) |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.openejb:openejb-derbynet",
"packageURL": "pkg:maven/org.apache.openejb/openejb-derbynet",
"product": "Apache TomEE",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "4.7.5",
"status": "affected",
"version": "4.0.0-beta-1",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.tomee:openejb-derbynet",
"packageURL": "pkg:maven/org.apache.tomee/openejb-derbynet",
"product": "Apache TomEE",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "10.0.0-M1",
"status": "affected",
"version": "7.0.0-M1",
"versionType": "semver"
},
{
"lessThan": "10.3.0",
"status": "affected",
"version": "10.0.0-M1",
"versionType": "semver"
},
{
"lessThan": "11.0.0-M2",
"status": "affected",
"version": "11.0.0-M1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "The Apache Software Foundation"
},
{
"lang": "en",
"type": "tool",
"value": "Claude Security"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Markus Jung"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The embedded Derby network service ignores its configured bind address and listens on all network interfaces. When the service is enabled, a remote attacker with network access can connect to the database server and read or modify data. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."
}
],
"value": "The embedded Derby network service ignores its configured bind address and listens on all network interfaces. When the service is enabled, a remote attacker with network access can connect to the database server and read or modify data. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1327",
"description": "CWE-1327 Binding to an Unrestricted IP Address",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T15:36:31.310Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/20fl5wnn3slxs0tq0ktmrc9xv9glffhq"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Apache TomEE: Derby network service listens on all interfaces",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-97849",
"datePublished": "2026-11-10T15:36:31.310Z",
"dateReserved": "2026-09-25T06:24:27.578Z",
"dateUpdated": "2026-11-10T15:36:31.310Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97867 (GCVE-0-2026-97867)
Vulnerability from cvelistv5 – Published: 2026-11-10 15:36 – Updated: 2026-11-10 15:36
VLAI
EPSS
VEX
Title
Apache TomEE: Database credential disclosure via remote JNDI lookup
Summary
The EJBd remote protocol returns datasource connection details, including database credentials, to remote clients that look up a datasource. A remote client able to reach the EJBd endpoint can obtain the database credentials and connect to the database directly. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
Severity
No CVSS data available.
CWE
- CWE-522 - Insufficiently Protected Credentials
Assigner
apache
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://lists.apache.org/thread/f6nqckc3wgqnnsrkb… | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache TomEE |
Affected:
4.0.0-beta-1 , ≤ 4.7.5
(semver)
|
|
| Apache Software Foundation | Apache TomEE |
Affected:
7.0.0-M1 , < 10.0.0-M1
(semver)
Affected: 10.0.0-M1 , < 10.3.0 (semver) Affected: 11.0.0-M1 , < 11.0.0-M2 (semver) |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.openejb:openejb-ejbd",
"packageURL": "pkg:maven/org.apache.openejb/openejb-ejbd",
"product": "Apache TomEE",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "4.7.5",
"status": "affected",
"version": "4.0.0-beta-1",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.tomee:openejb-ejbd",
"packageURL": "pkg:maven/org.apache.tomee/openejb-ejbd",
"product": "Apache TomEE",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "10.0.0-M1",
"status": "affected",
"version": "7.0.0-M1",
"versionType": "semver"
},
{
"lessThan": "10.3.0",
"status": "affected",
"version": "10.0.0-M1",
"versionType": "semver"
},
{
"lessThan": "11.0.0-M2",
"status": "affected",
"version": "11.0.0-M1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "The Apache Software Foundation"
},
{
"lang": "en",
"type": "tool",
"value": "Claude Security"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Markus Jung"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The EJBd remote protocol returns datasource connection details, including database credentials, to remote clients that look up a datasource. A remote client able to reach the EJBd endpoint can obtain the database credentials and connect to the database directly. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."
}
],
"value": "The EJBd remote protocol returns datasource connection details, including database credentials, to remote clients that look up a datasource. A remote client able to reach the EJBd endpoint can obtain the database credentials and connect to the database directly. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-522",
"description": "CWE-522 Insufficiently Protected Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T15:36:00.698Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/f6nqckc3wgqnnsrkb1hd640o3k4omfvr"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Apache TomEE: Database credential disclosure via remote JNDI lookup",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-97867",
"datePublished": "2026-11-10T15:36:00.698Z",
"dateReserved": "2026-09-25T08:23:52.192Z",
"dateUpdated": "2026-11-10T15:36:00.698Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97870 (GCVE-0-2026-97870)
Vulnerability from cvelistv5 – Published: 2026-11-10 15:34 – Updated: 2026-11-10 15:34
VLAI
EPSS
VEX
Title
Apache TomEE: Missing authentication for Hessian endpoints in embedded HTTP server
Summary
When Hessian remoting endpoints are served by the embedded HTTP server, configured authentication and transport security requirements are silently ignored. A remote unauthenticated attacker can invoke the exposed EJB methods without credentials or over an unencrypted connection. Only deployments that use the embedded HTTP server rather than Tomcat and rely on these settings are affected. Users are recommended to block network access to Hessian endpoints from untrusted clients, or to migrate to another remoting protocol.
Severity
No CVSS data available.
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
apache
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://lists.apache.org/thread/hvggn9r4nod9yrww9… | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache TomEE |
Affected:
4.6.0 , ≤ 4.7.5
(semver)
|
|
| Apache Software Foundation | Apache TomEE |
Affected:
7.0.0-M1 , < 10.0.0-M1
(semver)
Affected: 10.0.0-M1 , ≤ 10.2.0 (semver) Affected: 11.0.0-M1 (semver) |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.openejb:openejb-hessian",
"packageURL": "pkg:maven/org.apache.openejb/openejb-hessian",
"product": "Apache TomEE",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "4.7.5",
"status": "affected",
"version": "4.6.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.tomee:openejb-hessian",
"packageURL": "pkg:maven/org.apache.tomee/openejb-hessian",
"product": "Apache TomEE",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "10.0.0-M1",
"status": "affected",
"version": "7.0.0-M1",
"versionType": "semver"
},
{
"lessThanOrEqual": "10.2.0",
"status": "affected",
"version": "10.0.0-M1",
"versionType": "semver"
},
{
"status": "affected",
"version": "11.0.0-M1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "The Apache Software Foundation"
},
{
"lang": "en",
"type": "tool",
"value": "Claude Security"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Markus Jung"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "When Hessian remoting endpoints are served by the embedded HTTP server, configured authentication and transport security requirements are silently ignored. A remote unauthenticated attacker can invoke the exposed EJB methods without credentials or over an unencrypted connection. Only deployments that use the embedded HTTP server rather than Tomcat and rely on these settings are affected. Users are recommended to block network access to Hessian endpoints from untrusted clients, or to migrate to another remoting protocol."
}
],
"value": "When Hessian remoting endpoints are served by the embedded HTTP server, configured authentication and transport security requirements are silently ignored. A remote unauthenticated attacker can invoke the exposed EJB methods without credentials or over an unencrypted connection. Only deployments that use the embedded HTTP server rather than Tomcat and rely on these settings are affected. Users are recommended to block network access to Hessian endpoints from untrusted clients, or to migrate to another remoting protocol."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T15:34:49.580Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/hvggn9r4nod9yrww9qrz5vttcrcvomhz"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Apache TomEE: Missing authentication for Hessian endpoints in embedded HTTP server",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-97870",
"datePublished": "2026-11-10T15:34:49.580Z",
"dateReserved": "2026-09-25T08:30:32.898Z",
"dateUpdated": "2026-11-10T15:34:49.580Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97872 (GCVE-0-2026-97872)
Vulnerability from cvelistv5 – Published: 2026-11-10 15:34 – Updated: 2026-11-10 15:34
VLAI
EPSS
VEX
Title
Apache TomEE: Authentication bypass of Hessian EJB endpoints due to ignored security settings
Summary
When an EJB is exposed over the optional Hessian protocol inside an existing web application, some configured authentication and transport security settings are silently not enforced. A remote unauthenticated attacker can invoke the exposed EJB methods. Only deployments using the Hessian module with such settings are affected. Users are recommended to block network access to Hessian endpoints from untrusted clients, or to migrate to another remoting protocol.
Severity
No CVSS data available.
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
apache
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://lists.apache.org/thread/hythwhxfnmghgv21y… | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache TomEE |
Affected:
4.6.0 , ≤ 4.7.5
(semver)
|
|
| Apache Software Foundation | Apache TomEE |
Affected:
7.0.0-M1 , < 10.0.0-M1
(semver)
Affected: 10.0.0-M1 , ≤ 10.2.0 (semver) Affected: 11.0.0-M1 (semver) |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.openejb:openejb-hessian",
"packageURL": "pkg:maven/org.apache.openejb/openejb-hessian",
"product": "Apache TomEE",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "4.7.5",
"status": "affected",
"version": "4.6.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.tomee:openejb-hessian",
"packageURL": "pkg:maven/org.apache.tomee/openejb-hessian",
"product": "Apache TomEE",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "10.0.0-M1",
"status": "affected",
"version": "7.0.0-M1",
"versionType": "semver"
},
{
"lessThanOrEqual": "10.2.0",
"status": "affected",
"version": "10.0.0-M1",
"versionType": "semver"
},
{
"status": "affected",
"version": "11.0.0-M1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "The Apache Software Foundation"
},
{
"lang": "en",
"type": "tool",
"value": "Claude Security"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Markus Jung"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "When an EJB is exposed over the optional Hessian protocol inside an existing web application, some configured authentication and transport security settings are silently not enforced. A remote unauthenticated attacker can invoke the exposed EJB methods. Only deployments using the Hessian module with such settings are affected. Users are recommended to block network access to Hessian endpoints from untrusted clients, or to migrate to another remoting protocol."
}
],
"value": "When an EJB is exposed over the optional Hessian protocol inside an existing web application, some configured authentication and transport security settings are silently not enforced. A remote unauthenticated attacker can invoke the exposed EJB methods. Only deployments using the Hessian module with such settings are affected. Users are recommended to block network access to Hessian endpoints from untrusted clients, or to migrate to another remoting protocol."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T15:34:21.093Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/hythwhxfnmghgv21y2pw73s41qt99z72"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Apache TomEE: Authentication bypass of Hessian EJB endpoints due to ignored security settings",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-97872",
"datePublished": "2026-11-10T15:34:21.093Z",
"dateReserved": "2026-09-25T08:38:23.324Z",
"dateUpdated": "2026-11-10T15:34:21.093Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97874 (GCVE-0-2026-97874)
Vulnerability from cvelistv5 – Published: 2026-11-10 15:33 – Updated: 2026-11-10 15:33
VLAI
EPSS
VEX
Title
Apache TomEE: Authentication bypass for Hessian endpoints in non-root web applications
Summary
When Hessian remoting is configured with BASIC authentication, the authentication check is not applied to Hessian endpoints of applications deployed under a non-root context path. A remote unauthenticated attacker can invoke the exposed EJB methods without credentials. Users are recommended to block network access to Hessian endpoints from untrusted clients, or to migrate to another remoting protocol.
Severity
No CVSS data available.
CWE
- CWE-287 - Improper Authentication
Assigner
apache
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://lists.apache.org/thread/jl8dn3bdz52n8126g… | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache TomEE |
Affected:
4.6.0 , ≤ 4.7.5
(semver)
|
|
| Apache Software Foundation | Apache TomEE |
Affected:
7.0.0-M1 , < 10.0.0-M1
(semver)
Affected: 10.0.0-M1 , ≤ 10.2.0 (semver) Affected: 11.0.0-M1 (semver) |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.openejb:openejb-hessian",
"packageURL": "pkg:maven/org.apache.openejb/openejb-hessian",
"product": "Apache TomEE",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "4.7.5",
"status": "affected",
"version": "4.6.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.tomee:openejb-hessian",
"packageURL": "pkg:maven/org.apache.tomee/openejb-hessian",
"product": "Apache TomEE",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "10.0.0-M1",
"status": "affected",
"version": "7.0.0-M1",
"versionType": "semver"
},
{
"lessThanOrEqual": "10.2.0",
"status": "affected",
"version": "10.0.0-M1",
"versionType": "semver"
},
{
"status": "affected",
"version": "11.0.0-M1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "The Apache Software Foundation"
},
{
"lang": "en",
"type": "tool",
"value": "Claude Security"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Markus Jung"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "When Hessian remoting is configured with BASIC authentication, the authentication check is not applied to Hessian endpoints of applications deployed under a non-root context path. A remote unauthenticated attacker can invoke the exposed EJB methods without credentials. Users are recommended to block network access to Hessian endpoints from untrusted clients, or to migrate to another remoting protocol."
}
],
"value": "When Hessian remoting is configured with BASIC authentication, the authentication check is not applied to Hessian endpoints of applications deployed under a non-root context path. A remote unauthenticated attacker can invoke the exposed EJB methods without credentials. Users are recommended to block network access to Hessian endpoints from untrusted clients, or to migrate to another remoting protocol."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287 Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T15:33:58.193Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/jl8dn3bdz52n8126gvc85nddprkwjhmq"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Apache TomEE: Authentication bypass for Hessian endpoints in non-root web applications",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-97874",
"datePublished": "2026-11-10T15:33:58.193Z",
"dateReserved": "2026-09-25T08:43:57.047Z",
"dateUpdated": "2026-11-10T15:33:58.193Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97880 (GCVE-0-2026-97880)
Vulnerability from cvelistv5 – Published: 2026-11-10 15:33 – Updated: 2026-11-10 15:33
VLAI
EPSS
VEX
Title
Apache TomEE: Authentication bypass in the embedded HTTP server for endpoints protected by HTTP Basic authentication
Summary
The embedded OpenEJB HTTP server dispatches some requests to REST endpoints configured for HTTP Basic authentication without verifying credentials. A remote unauthenticated attacker can invoke protected resources, bypassing authentication. Only deployments that use the embedded HTTP server with Basic authentication are affected. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions.
Severity
No CVSS data available.
CWE
- CWE-287 - Improper Authentication
Assigner
apache
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://lists.apache.org/thread/fm51rhyqmjv2b9hph… | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache TomEE |
Affected:
4.0.0-beta-1 , ≤ 4.7.5
(semver)
|
|
| Apache Software Foundation | Apache TomEE |
Affected:
7.0.0-M1 , < 10.0.0-M1
(semver)
Affected: 10.0.0-M1 , ≤ 10.2.0 (semver) Affected: 11.0.0-M1 (semver) |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.openejb:openejb-http",
"packageURL": "pkg:maven/org.apache.openejb/openejb-http",
"product": "Apache TomEE",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "4.7.5",
"status": "affected",
"version": "4.0.0-beta-1",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.tomee:openejb-http",
"packageURL": "pkg:maven/org.apache.tomee/openejb-http",
"product": "Apache TomEE",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "10.0.0-M1",
"status": "affected",
"version": "7.0.0-M1",
"versionType": "semver"
},
{
"lessThanOrEqual": "10.2.0",
"status": "affected",
"version": "10.0.0-M1",
"versionType": "semver"
},
{
"status": "affected",
"version": "11.0.0-M1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "The Apache Software Foundation"
},
{
"lang": "en",
"type": "tool",
"value": "Claude Security"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Markus Jung"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The embedded OpenEJB HTTP server dispatches some requests to REST endpoints configured for HTTP Basic authentication without verifying credentials. A remote unauthenticated attacker can invoke protected resources, bypassing authentication. Only deployments that use the embedded HTTP server with Basic authentication are affected. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions."
}
],
"value": "The embedded OpenEJB HTTP server dispatches some requests to REST endpoints configured for HTTP Basic authentication without verifying credentials. A remote unauthenticated attacker can invoke protected resources, bypassing authentication. Only deployments that use the embedded HTTP server with Basic authentication are affected. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287 Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T15:33:22.154Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/fm51rhyqmjv2b9hphro608thj4yr4ngx"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Apache TomEE: Authentication bypass in the embedded HTTP server for endpoints protected by HTTP Basic authentication",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-97880",
"datePublished": "2026-11-10T15:33:22.154Z",
"dateReserved": "2026-09-25T09:01:26.528Z",
"dateUpdated": "2026-11-10T15:33:22.154Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97881 (GCVE-0-2026-97881)
Vulnerability from cvelistv5 – Published: 2026-11-10 15:32 – Updated: 2026-11-10 15:32
VLAI
EPSS
VEX
Title
Apache TomEE: Path traversal in embedded HTTP server static resource handling
Summary
The embedded OpenEJB HTTP server does not restrict static resource paths to the configured resource directories. A remote unauthenticated attacker can read arbitrary files accessible to the server process. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions.
Severity
No CVSS data available.
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
apache
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://lists.apache.org/thread/pptsyzp963c01nmss… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache TomEE |
Affected:
7.0.0-M1 , < 10.0.0-M1
(semver)
Affected: 10.0.0-M1 , ≤ 10.2.0 (semver) Affected: 11.0.0-M1 (semver) |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.tomee:openejb-http",
"packageURL": "pkg:maven/org.apache.tomee/openejb-http",
"product": "Apache TomEE",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "10.0.0-M1",
"status": "affected",
"version": "7.0.0-M1",
"versionType": "semver"
},
{
"lessThanOrEqual": "10.2.0",
"status": "affected",
"version": "10.0.0-M1",
"versionType": "semver"
},
{
"status": "affected",
"version": "11.0.0-M1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "The Apache Software Foundation"
},
{
"lang": "en",
"type": "tool",
"value": "Claude Security"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Markus Jung"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The embedded OpenEJB HTTP server does not restrict static resource paths to the configured resource directories. A remote unauthenticated attacker can read arbitrary files accessible to the server process. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions."
}
],
"value": "The embedded OpenEJB HTTP server does not restrict static resource paths to the configured resource directories. A remote unauthenticated attacker can read arbitrary files accessible to the server process. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T15:32:37.309Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/pptsyzp963c01nmss9hn7p68pthzdnp9"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Apache TomEE: Path traversal in embedded HTTP server static resource handling",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-97881",
"datePublished": "2026-11-10T15:32:37.309Z",
"dateReserved": "2026-09-25T09:05:14.206Z",
"dateUpdated": "2026-11-10T15:32:37.309Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97888 (GCVE-0-2026-97888)
Vulnerability from cvelistv5 – Published: 2026-11-10 15:32 – Updated: 2026-11-10 15:32
VLAI
EPSS
VEX
Title
Apache TomEE: Caller identity leaks across requests in embedded HTTP server
Summary
The embedded HTTP server does not clear the security identity established during a request before its worker thread handles the next request. A remote unauthenticated attacker can have their request processed with the identity of a previously authenticated user, gaining that user's privileges. Only applications served by the embedded HTTP server that authenticate programmatically or via basic authentication are affected. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions.
Severity
No CVSS data available.
CWE
- CWE-488 - Exposure of Data Element to Wrong Session
Assigner
apache
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://lists.apache.org/thread/7snc0d5bd2hvk1416… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache TomEE |
Affected:
7.0.0-M1 , < 10.0.0-M1
(semver)
Affected: 10.0.0-M1 , ≤ 10.2.0 (semver) Affected: 11.0.0-M1 (semver) |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.tomee:openejb-http",
"packageURL": "pkg:maven/org.apache.tomee/openejb-http",
"product": "Apache TomEE",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "10.0.0-M1",
"status": "affected",
"version": "7.0.0-M1",
"versionType": "semver"
},
{
"lessThanOrEqual": "10.2.0",
"status": "affected",
"version": "10.0.0-M1",
"versionType": "semver"
},
{
"status": "affected",
"version": "11.0.0-M1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "The Apache Software Foundation"
},
{
"lang": "en",
"type": "tool",
"value": "Claude Security"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Markus Jung"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The embedded HTTP server does not clear the security identity established during a request before its worker thread handles the next request. A remote unauthenticated attacker can have their request processed with the identity of a previously authenticated user, gaining that user\u0027s privileges. Only applications served by the embedded HTTP server that authenticate programmatically or via basic authentication are affected. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions."
}
],
"value": "The embedded HTTP server does not clear the security identity established during a request before its worker thread handles the next request. A remote unauthenticated attacker can have their request processed with the identity of a previously authenticated user, gaining that user\u0027s privileges. Only applications served by the embedded HTTP server that authenticate programmatically or via basic authentication are affected. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-488",
"description": "CWE-488 Exposure of Data Element to Wrong Session",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T15:32:11.947Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/7snc0d5bd2hvk1416v5b34pjgn0mmdvn"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Apache TomEE: Caller identity leaks across requests in embedded HTTP server",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-97888",
"datePublished": "2026-11-10T15:32:11.947Z",
"dateReserved": "2026-09-25T09:10:43.640Z",
"dateUpdated": "2026-11-10T15:32:11.947Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97890 (GCVE-0-2026-97890)
Vulnerability from cvelistv5 – Published: 2026-11-10 15:31 – Updated: 2026-11-10 15:31
VLAI
EPSS
VEX
Title
Apache TomEE: Session fixation in embedded HTTP server
Summary
The embedded HTTP server does not invalidate the previous session identifier when an application changes the session id, e.g. after login. An attacker who can plant a session identifier in a victim's browser can hijack the victim's authenticated session. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions.
Severity
No CVSS data available.
CWE
- CWE-384 - Session Fixation
Assigner
apache
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://lists.apache.org/thread/2wx7lvso54j2xp6m7… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache TomEE |
Affected:
7.0.0-M1 , < 10.0.0-M1
(semver)
Affected: 10.0.0-M1 , ≤ 10.2.0 (semver) Affected: 11.0.0-M1 (semver) |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.tomee:openejb-http",
"packageURL": "pkg:maven/org.apache.tomee/openejb-http",
"product": "Apache TomEE",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "10.0.0-M1",
"status": "affected",
"version": "7.0.0-M1",
"versionType": "semver"
},
{
"lessThanOrEqual": "10.2.0",
"status": "affected",
"version": "10.0.0-M1",
"versionType": "semver"
},
{
"status": "affected",
"version": "11.0.0-M1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "The Apache Software Foundation"
},
{
"lang": "en",
"type": "tool",
"value": "Claude Security"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Markus Jung"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The embedded HTTP server does not invalidate the previous session identifier when an application changes the session id, e.g. after login. An attacker who can plant a session identifier in a victim\u0027s browser can hijack the victim\u0027s authenticated session. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions."
}
],
"value": "The embedded HTTP server does not invalidate the previous session identifier when an application changes the session id, e.g. after login. An attacker who can plant a session identifier in a victim\u0027s browser can hijack the victim\u0027s authenticated session. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions."
}
],
"metrics": [
{
"other": {
"content": {
"text": "low"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-384",
"description": "CWE-384 Session Fixation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T15:31:25.681Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/2wx7lvso54j2xp6m7omq12hkcb9tfzjx"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Apache TomEE: Session fixation in embedded HTTP server",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-97890",
"datePublished": "2026-11-10T15:31:25.681Z",
"dateReserved": "2026-09-25T09:27:03.286Z",
"dateUpdated": "2026-11-10T15:31:25.681Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111239 (GCVE-0-2026-111239)
Vulnerability from cvelistv5 – Published: 2026-11-10 15:30 – Updated: 2026-11-10 15:30
VLAI
EPSS
VEX
Title
Apache TomEE: Code execution by any authenticated user via the SSH administration shell
Summary
The optional SSH administration service grants full access to the administration shell to every user that authenticates against its configured login domain, without checking for an administrative role. An attacker holding the credentials of any user in that domain, including a low-privileged application user, can execute arbitrary code as the server process. Users are recommended to disable the SSH administration service, or to block network access to it from untrusted clients and restrict its login domain to administrative users.
Severity
No CVSS data available.
CWE
- CWE-862 - Missing Authorization
Assigner
apache
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://lists.apache.org/thread/wfoxj510yol03lmzb… | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache TomEE |
Affected:
4.0.0 , ≤ 4.7.5
(semver)
|
|
| Apache Software Foundation | Apache TomEE |
Affected:
7.0.0-M1 , < 10.0.0-M1
(semver)
Affected: 10.0.0-M1 , ≤ 10.2.0 (semver) Affected: 11.0.0-M1 (semver) |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.openejb:openejb-ssh",
"packageURL": "pkg:maven/org.apache.openejb/openejb-ssh",
"product": "Apache TomEE",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "4.7.5",
"status": "affected",
"version": "4.0.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.tomee:openejb-ssh",
"packageURL": "pkg:maven/org.apache.tomee/openejb-ssh",
"product": "Apache TomEE",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "10.0.0-M1",
"status": "affected",
"version": "7.0.0-M1",
"versionType": "semver"
},
{
"lessThanOrEqual": "10.2.0",
"status": "affected",
"version": "10.0.0-M1",
"versionType": "semver"
},
{
"status": "affected",
"version": "11.0.0-M1",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.openejb:openejb-common-cli",
"packageURL": "pkg:maven/org.apache.openejb/openejb-common-cli",
"product": "Apache TomEE",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "4.7.5",
"status": "affected",
"version": "4.0.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.tomee:openejb-common-cli",
"packageURL": "pkg:maven/org.apache.tomee/openejb-common-cli",
"product": "Apache TomEE",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "10.0.0-M1",
"status": "affected",
"version": "7.0.0-M1",
"versionType": "semver"
},
{
"lessThanOrEqual": "10.2.0",
"status": "affected",
"version": "10.0.0-M1",
"versionType": "semver"
},
{
"status": "affected",
"version": "11.0.0-M1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "The Apache Software Foundation"
},
{
"lang": "en",
"type": "tool",
"value": "Claude Security"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Richard Zowalla"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The optional SSH administration service grants full access to the administration shell to every user that authenticates against its configured login domain, without checking for an administrative role. An attacker holding the credentials of any user in that domain, including a low-privileged application user, can execute arbitrary code as the server process. Users are recommended to disable the SSH administration service, or to block network access to it from untrusted clients and restrict its login domain to administrative users."
}
],
"value": "The optional SSH administration service grants full access to the administration shell to every user that authenticates against its configured login domain, without checking for an administrative role. An attacker holding the credentials of any user in that domain, including a low-privileged application user, can execute arbitrary code as the server process. Users are recommended to disable the SSH administration service, or to block network access to it from untrusted clients and restrict its login domain to administrative users."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T15:30:57.925Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/wfoxj510yol03lmzbzdftyphwvtq87wg"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Apache TomEE: Code execution by any authenticated user via the SSH administration shell",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-111239",
"datePublished": "2026-11-10T15:30:57.925Z",
"dateReserved": "2026-10-15T18:35:58.969Z",
"dateUpdated": "2026-11-10T15:30:57.925Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111240 (GCVE-0-2026-111240)
Vulnerability from cvelistv5 – Published: 2026-11-10 15:30 – Updated: 2026-11-10 15:30
VLAI
EPSS
VEX
Title
Apache TomEE: Authentication bypass for accounts without a stored password in SQL login module
Summary
The JDBC based JAAS login module accepts a login without a password for accounts whose stored password is NULL. A remote attacker who knows the user name of such an account can authenticate as that user and obtain its roles. Only deployments using this login module with NULL passwords in the user table are affected. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
Severity
No CVSS data available.
CWE
- CWE-287 - Improper Authentication
Assigner
apache
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://lists.apache.org/thread/1w1olwsbzpsj7mnv8… | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache TomEE |
Affected:
4.0.0-beta-1 , ≤ 4.7.5
(semver)
|
|
| Apache Software Foundation | Apache TomEE |
Affected:
7.0.0-M1 , < 10.0.0-M1
(semver)
Affected: 10.0.0-M1 , < 10.3.0 (semver) Affected: 11.0.0-M1 , < 11.0.0-M2 (semver) |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.openejb:openejb-core",
"packageURL": "pkg:maven/org.apache.openejb/openejb-core",
"product": "Apache TomEE",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "4.7.5",
"status": "affected",
"version": "4.0.0-beta-1",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.tomee:openejb-core",
"packageURL": "pkg:maven/org.apache.tomee/openejb-core",
"product": "Apache TomEE",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "10.0.0-M1",
"status": "affected",
"version": "7.0.0-M1",
"versionType": "semver"
},
{
"lessThan": "10.3.0",
"status": "affected",
"version": "10.0.0-M1",
"versionType": "semver"
},
{
"lessThan": "11.0.0-M2",
"status": "affected",
"version": "11.0.0-M1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "The Apache Software Foundation"
},
{
"lang": "en",
"type": "tool",
"value": "Claude Security"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Richard Zowalla"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The JDBC based JAAS login module accepts a login without a password for accounts whose stored password is NULL. A remote attacker who knows the user name of such an account can authenticate as that user and obtain its roles. Only deployments using this login module with NULL passwords in the user table are affected. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."
}
],
"value": "The JDBC based JAAS login module accepts a login without a password for accounts whose stored password is NULL. A remote attacker who knows the user name of such an account can authenticate as that user and obtain its roles. Only deployments using this login module with NULL passwords in the user table are affected. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287 Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T15:30:28.843Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/1w1olwsbzpsj7mnv8v3vj30ohq0t0c52"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Apache TomEE: Authentication bypass for accounts without a stored password in SQL login module",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-111240",
"datePublished": "2026-11-10T15:30:28.843Z",
"dateReserved": "2026-10-15T18:36:23.079Z",
"dateUpdated": "2026-11-10T15:30:28.843Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111241 (GCVE-0-2026-111241)
Vulnerability from cvelistv5 – Published: 2026-11-10 15:30 – Updated: 2026-11-10 15:30
VLAI
EPSS
VEX
Title
Apache TomEE: Local code execution via predictable passivation files in the shared temporary directory
Summary
When a non-default stateful session bean passivation strategy is configured, passivated bean state is written to predictably named files in the shared system temporary directory, reusing files that already exist there, and is deserialized on activation. A local attacker who can write to that directory can read passivated session state or supply data that the server deserializes, potentially leading to code execution as the server process. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
Severity
No CVSS data available.
CWE
- CWE-377 - Insecure Temporary File
Assigner
apache
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://lists.apache.org/thread/kbpc7t241483pnxo2… | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache TomEE |
Affected:
4.0.0-beta-1 , ≤ 4.7.5
(semver)
|
|
| Apache Software Foundation | Apache TomEE |
Affected:
7.0.0-M1 , < 10.0.0-M1
(semver)
Affected: 10.0.0-M1 , < 10.3.0 (semver) Affected: 11.0.0-M1 , < 11.0.0-M2 (semver) |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.openejb:openejb-core",
"packageURL": "pkg:maven/org.apache.openejb/openejb-core",
"product": "Apache TomEE",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "4.7.5",
"status": "affected",
"version": "4.0.0-beta-1",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.tomee:openejb-core",
"packageURL": "pkg:maven/org.apache.tomee/openejb-core",
"product": "Apache TomEE",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "10.0.0-M1",
"status": "affected",
"version": "7.0.0-M1",
"versionType": "semver"
},
{
"lessThan": "10.3.0",
"status": "affected",
"version": "10.0.0-M1",
"versionType": "semver"
},
{
"lessThan": "11.0.0-M2",
"status": "affected",
"version": "11.0.0-M1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "The Apache Software Foundation"
},
{
"lang": "en",
"type": "tool",
"value": "Claude Security"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Richard Zowalla"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "When a non-default stateful session bean passivation strategy is configured, passivated bean state is written to predictably named files in the shared system temporary directory, reusing files that already exist there, and is deserialized on activation. A local attacker who can write to that directory can read passivated session state or supply data that the server deserializes, potentially leading to code execution as the server process. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."
}
],
"value": "When a non-default stateful session bean passivation strategy is configured, passivated bean state is written to predictably named files in the shared system temporary directory, reusing files that already exist there, and is deserialized on activation. A local attacker who can write to that directory can read passivated session state or supply data that the server deserializes, potentially leading to code execution as the server process. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-377",
"description": "CWE-377 Insecure Temporary File",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T15:30:03.453Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/kbpc7t241483pnxo2sccrhyp6pjkwbq2"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Apache TomEE: Local code execution via predictable passivation files in the shared temporary directory",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-111241",
"datePublished": "2026-11-10T15:30:03.453Z",
"dateReserved": "2026-10-15T18:36:37.138Z",
"dateUpdated": "2026-11-10T15:30:03.453Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111242 (GCVE-0-2026-111242)
Vulnerability from cvelistv5 – Published: 2026-11-10 15:29 – Updated: 2026-11-10 15:29
VLAI
EPSS
VEX
Title
Apache TomEE: Privilege escalation via leaked MicroProfile JWT run-as identity
Summary
When MicroProfile JWT authentication is used for servlets that declare a run-as identity, the security state established for a request is not always cleared from the processing thread when the request does not complete normally. A remote attacker holding a valid token can cause later, unrelated requests served by the same thread to invoke enterprise beans with the elevated run-as identity. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
Severity
No CVSS data available.
CWE
- CWE-488 - Exposure of Data Element to Wrong Session
Assigner
apache
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://lists.apache.org/thread/opr1oob7p8xtqwcj1… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache TomEE |
Affected:
8.0.0-M2 , < 10.0.0-M1
(semver)
Affected: 10.0.0-M1 , < 10.3.0 (semver) Affected: 11.0.0-M1 , < 11.0.0-M2 (semver) |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.tomee:mp-jwt",
"packageURL": "pkg:maven/org.apache.tomee/mp-jwt",
"product": "Apache TomEE",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "10.0.0-M1",
"status": "affected",
"version": "8.0.0-M2",
"versionType": "semver"
},
{
"lessThan": "10.3.0",
"status": "affected",
"version": "10.0.0-M1",
"versionType": "semver"
},
{
"lessThan": "11.0.0-M2",
"status": "affected",
"version": "11.0.0-M1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "The Apache Software Foundation"
},
{
"lang": "en",
"type": "tool",
"value": "Claude Security"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Richard Zowalla"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "When MicroProfile JWT authentication is used for servlets that declare a run-as identity, the security state established for a request is not always cleared from the processing thread when the request does not complete normally. A remote attacker holding a valid token can cause later, unrelated requests served by the same thread to invoke enterprise beans with the elevated run-as identity. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."
}
],
"value": "When MicroProfile JWT authentication is used for servlets that declare a run-as identity, the security state established for a request is not always cleared from the processing thread when the request does not complete normally. A remote attacker holding a valid token can cause later, unrelated requests served by the same thread to invoke enterprise beans with the elevated run-as identity. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-488",
"description": "CWE-488 Exposure of Data Element to Wrong Session",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T15:29:39.851Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/opr1oob7p8xtqwcj1yv2dnsj4zqo9f03"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Apache TomEE: Privilege escalation via leaked MicroProfile JWT run-as identity",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-111242",
"datePublished": "2026-11-10T15:29:39.851Z",
"dateReserved": "2026-10-15T18:36:37.446Z",
"dateUpdated": "2026-11-10T15:29:39.851Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111243 (GCVE-0-2026-111243)
Vulnerability from cvelistv5 – Published: 2026-11-10 15:29 – Updated: 2026-11-10 15:29
VLAI
EPSS
VEX
Title
Apache TomEE: Expired MicroProfile JWT tokens accepted with negative clock skew
Summary
A negative MicroProfile JWT clock skew setting is not rejected and disables validation of the token expiration and other time-based claims. In such configurations, an attacker in possession of an expired token can still authenticate with it. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
Severity
No CVSS data available.
CWE
- CWE-613 - Insufficient Session Expiration
Assigner
apache
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://lists.apache.org/thread/zb9sshs1fhz72llk3… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache TomEE |
Affected:
10.0.0-M1 , < 10.3.0
(semver)
Affected: 11.0.0-M1 , < 11.0.0-M2 (semver) |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.tomee:mp-jwt",
"packageURL": "pkg:maven/org.apache.tomee/mp-jwt",
"product": "Apache TomEE",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "10.3.0",
"status": "affected",
"version": "10.0.0-M1",
"versionType": "semver"
},
{
"lessThan": "11.0.0-M2",
"status": "affected",
"version": "11.0.0-M1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "The Apache Software Foundation"
},
{
"lang": "en",
"type": "tool",
"value": "Claude Security"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Richard Zowalla"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A negative MicroProfile JWT clock skew setting is not rejected and disables validation of the token expiration and other time-based claims. In such configurations, an attacker in possession of an expired token can still authenticate with it. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."
}
],
"value": "A negative MicroProfile JWT clock skew setting is not rejected and disables validation of the token expiration and other time-based claims. In such configurations, an attacker in possession of an expired token can still authenticate with it. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "low"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-613",
"description": "CWE-613 Insufficient Session Expiration",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T15:29:16.574Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/zb9sshs1fhz72llk3bb20ksw50n9jhqp"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Apache TomEE: Expired MicroProfile JWT tokens accepted with negative clock skew",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-111243",
"datePublished": "2026-11-10T15:29:16.574Z",
"dateReserved": "2026-10-15T18:36:37.732Z",
"dateUpdated": "2026-11-10T15:29:16.574Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111244 (GCVE-0-2026-111244)
Vulnerability from cvelistv5 – Published: 2026-11-10 15:27 – Updated: 2026-11-10 15:27
VLAI
EPSS
VEX
Title
Apache TomEE: Authorization bypass in MicroProfile JWT role checks for JAX-RS resources
Summary
When MicroProfile JWT role-based access control is used, the access constraints of JAX-RS resources are not always enforced as declared: resources that declare an empty set of allowed roles are accessible to every caller, resource classes that inherit the same method from a common superclass share their constraints, and class-level constraints declared on a superclass are ignored. A remote attacker can invoke resources that should be denied to them, in some configurations without authentication. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
Severity
No CVSS data available.
CWE
- CWE-863 - Incorrect Authorization
Assigner
apache
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://lists.apache.org/thread/flpx4mgmzqx36fm6g… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache TomEE |
Affected:
7.1.0 , < 10.0.0-M1
(semver)
Affected: 10.0.0-M1 , < 10.3.0 (semver) Affected: 11.0.0-M1 , < 11.0.0-M2 (semver) |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.tomee:mp-jwt",
"packageURL": "pkg:maven/org.apache.tomee/mp-jwt",
"product": "Apache TomEE",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "10.0.0-M1",
"status": "affected",
"version": "7.1.0",
"versionType": "semver"
},
{
"lessThan": "10.3.0",
"status": "affected",
"version": "10.0.0-M1",
"versionType": "semver"
},
{
"lessThan": "11.0.0-M2",
"status": "affected",
"version": "11.0.0-M1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "The Apache Software Foundation"
},
{
"lang": "en",
"type": "tool",
"value": "Claude Security"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Richard Zowalla"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "When MicroProfile JWT role-based access control is used, the access constraints of JAX-RS resources are not always enforced as declared: resources that declare an empty set of allowed roles are accessible to every caller, resource classes that inherit the same method from a common superclass share their constraints, and class-level constraints declared on a superclass are ignored. A remote attacker can invoke resources that should be denied to them, in some configurations without authentication. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."
}
],
"value": "When MicroProfile JWT role-based access control is used, the access constraints of JAX-RS resources are not always enforced as declared: resources that declare an empty set of allowed roles are accessible to every caller, resource classes that inherit the same method from a common superclass share their constraints, and class-level constraints declared on a superclass are ignored. A remote attacker can invoke resources that should be denied to them, in some configurations without authentication. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "important"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T15:27:04.378Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/flpx4mgmzqx36fm6gy3thcoh74b5yz7o"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Apache TomEE: Authorization bypass in MicroProfile JWT role checks for JAX-RS resources",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-111244",
"datePublished": "2026-11-10T15:27:04.378Z",
"dateReserved": "2026-10-15T18:36:38.024Z",
"dateUpdated": "2026-11-10T15:27:04.378Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111245 (GCVE-0-2026-111245)
Vulnerability from cvelistv5 – Published: 2026-11-10 15:24 – Updated: 2026-11-10 15:24
VLAI
EPSS
VEX
Title
Apache TomEE: Privilege escalation via WS-Security caller identity leaking between requests
Summary
After a successful WS-Security UsernameToken authentication, the caller identity stays associated with the worker thread once the request completes when web services are served by the standalone OpenEJB HTTP server. A remote unauthenticated attacker whose request is later processed on the same thread can invoke protected EJB methods with the identity of a previously authenticated user. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
Severity
No CVSS data available.
CWE
- CWE-488 - Exposure of Data Element to Wrong Session
Assigner
apache
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://lists.apache.org/thread/6nr7gp3kxf919mhv2… | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache TomEE |
Affected:
4.0.0-beta-1 , ≤ 4.7.5
(semver)
|
|
| Apache Software Foundation | Apache TomEE |
Affected:
7.0.0-M1 , < 10.0.0-M1
(semver)
Affected: 10.0.0-M1 , < 10.3.0 (semver) Affected: 11.0.0-M1 , < 11.0.0-M2 (semver) |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.openejb:openejb-cxf",
"packageURL": "pkg:maven/org.apache.openejb/openejb-cxf",
"product": "Apache TomEE",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "4.7.5",
"status": "affected",
"version": "4.0.0-beta-1",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.tomee:openejb-cxf",
"packageURL": "pkg:maven/org.apache.tomee/openejb-cxf",
"product": "Apache TomEE",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "10.0.0-M1",
"status": "affected",
"version": "7.0.0-M1",
"versionType": "semver"
},
{
"lessThan": "10.3.0",
"status": "affected",
"version": "10.0.0-M1",
"versionType": "semver"
},
{
"lessThan": "11.0.0-M2",
"status": "affected",
"version": "11.0.0-M1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "The Apache Software Foundation"
},
{
"lang": "en",
"type": "tool",
"value": "Claude Security"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Richard Zowalla"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "After a successful WS-Security UsernameToken authentication, the caller identity stays associated with the worker thread once the request completes when web services are served by the standalone OpenEJB HTTP server. A remote unauthenticated attacker whose request is later processed on the same thread can invoke protected EJB methods with the identity of a previously authenticated user. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."
}
],
"value": "After a successful WS-Security UsernameToken authentication, the caller identity stays associated with the worker thread once the request completes when web services are served by the standalone OpenEJB HTTP server. A remote unauthenticated attacker whose request is later processed on the same thread can invoke protected EJB methods with the identity of a previously authenticated user. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-488",
"description": "CWE-488 Exposure of Data Element to Wrong Session",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T15:24:08.081Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/6nr7gp3kxf919mhv2o0yg45t310x5go8"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Apache TomEE: Privilege escalation via WS-Security caller identity leaking between requests",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-111245",
"datePublished": "2026-11-10T15:24:08.081Z",
"dateReserved": "2026-10-15T18:36:38.336Z",
"dateUpdated": "2026-11-10T15:24:08.081Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111246 (GCVE-0-2026-111246)
Vulnerability from cvelistv5 – Published: 2026-11-10 15:23 – Updated: 2026-11-10 15:23
VLAI
EPSS
VEX
Title
Apache TomEE: HTTP sessions shared across web applications in embedded HTTP server
Summary
The embedded OpenEJB HTTP server does not isolate HTTP sessions between web applications. A remote attacker can use a session established in one web application in another one, which then trusts session state set by the first application. Only deployments hosting several web applications on the embedded HTTP server are affected. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions.
Severity
No CVSS data available.
CWE
- CWE-668 - Exposure of Resource to Wrong Sphere
Assigner
apache
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://lists.apache.org/thread/3l9twg2ywvgwjffv4… | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache TomEE |
Affected:
4.5.2 , ≤ 4.7.5
(semver)
|
|
| Apache Software Foundation | Apache TomEE |
Affected:
7.0.0-M1 , < 10.0.0-M1
(semver)
Affected: 10.0.0-M1 , ≤ 10.2.0 (semver) Affected: 11.0.0-M1 (semver) |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.openejb:openejb-http",
"packageURL": "pkg:maven/org.apache.openejb/openejb-http",
"product": "Apache TomEE",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "4.7.5",
"status": "affected",
"version": "4.5.2",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.tomee:openejb-http",
"packageURL": "pkg:maven/org.apache.tomee/openejb-http",
"product": "Apache TomEE",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "10.0.0-M1",
"status": "affected",
"version": "7.0.0-M1",
"versionType": "semver"
},
{
"lessThanOrEqual": "10.2.0",
"status": "affected",
"version": "10.0.0-M1",
"versionType": "semver"
},
{
"status": "affected",
"version": "11.0.0-M1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "The Apache Software Foundation"
},
{
"lang": "en",
"type": "tool",
"value": "Claude Security"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Richard Zowalla"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The embedded OpenEJB HTTP server does not isolate HTTP sessions between web applications. A remote attacker can use a session established in one web application in another one, which then trusts session state set by the first application. Only deployments hosting several web applications on the embedded HTTP server are affected. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions."
}
],
"value": "The embedded OpenEJB HTTP server does not isolate HTTP sessions between web applications. A remote attacker can use a session established in one web application in another one, which then trusts session state set by the first application. Only deployments hosting several web applications on the embedded HTTP server are affected. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions."
}
],
"metrics": [
{
"other": {
"content": {
"text": "low"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-668",
"description": "CWE-668 Exposure of Resource to Wrong Sphere",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T15:23:45.682Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/3l9twg2ywvgwjffv4wwop2fmtp05fp39"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Apache TomEE: HTTP sessions shared across web applications in embedded HTTP server",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-111246",
"datePublished": "2026-11-10T15:23:45.682Z",
"dateReserved": "2026-10-15T18:36:38.645Z",
"dateUpdated": "2026-11-10T15:23:45.682Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111247 (GCVE-0-2026-111247)
Vulnerability from cvelistv5 – Published: 2026-11-10 15:23 – Updated: 2026-11-10 15:23
VLAI
EPSS
VEX
Title
Apache TomEE: Privilege escalation via user name matching a role name
Summary
When resolving security roles of a realm-authenticated caller, the caller's user name is also treated as a role name in addition to the roles assigned by the realm. An authenticated attacker who can obtain an account whose user name equals a role name, for example through self-registration, is granted that role wherever authorization is evaluated through the Jakarta Authorization policy. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
Severity
No CVSS data available.
CWE
- CWE-863 - Incorrect Authorization
Assigner
apache
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://lists.apache.org/thread/wmx75ytmp7d5h8cnd… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache TomEE |
Affected:
8.0.7 , < 10.0.0-M1
(semver)
Affected: 10.0.0-M1 , < 10.3.0 (semver) Affected: 11.0.0-M1 , < 11.0.0-M2 (semver) |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.tomee:tomee-catalina",
"packageURL": "pkg:maven/org.apache.tomee/tomee-catalina",
"product": "Apache TomEE",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "10.0.0-M1",
"status": "affected",
"version": "8.0.7",
"versionType": "semver"
},
{
"lessThan": "10.3.0",
"status": "affected",
"version": "10.0.0-M1",
"versionType": "semver"
},
{
"lessThan": "11.0.0-M2",
"status": "affected",
"version": "11.0.0-M1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "The Apache Software Foundation"
},
{
"lang": "en",
"type": "tool",
"value": "Claude Security"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Richard Zowalla"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "When resolving security roles of a realm-authenticated caller, the caller\u0027s user name is also treated as a role name in addition to the roles assigned by the realm. An authenticated attacker who can obtain an account whose user name equals a role name, for example through self-registration, is granted that role wherever authorization is evaluated through the Jakarta Authorization policy. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."
}
],
"value": "When resolving security roles of a realm-authenticated caller, the caller\u0027s user name is also treated as a role name in addition to the roles assigned by the realm. An authenticated attacker who can obtain an account whose user name equals a role name, for example through self-registration, is granted that role wherever authorization is evaluated through the Jakarta Authorization policy. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T15:23:23.893Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/wmx75ytmp7d5h8cnd8jf1lg2gbw983f3"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Apache TomEE: Privilege escalation via user name matching a role name",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-111247",
"datePublished": "2026-11-10T15:23:23.893Z",
"dateReserved": "2026-10-15T18:36:39.015Z",
"dateUpdated": "2026-11-10T15:23:23.893Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111248 (GCVE-0-2026-111248)
Vulnerability from cvelistv5 – Published: 2026-11-10 15:22 – Updated: 2026-11-10 15:22
VLAI
EPSS
VEX
Title
Apache TomEE: Authentication with the stored password digest in Tomcat user identity store
Summary
The Jakarta Security identity store backed by the Tomcat user database compares the supplied password with the stored value as plain text and ignores the configured credential handler. When digested passwords are stored, an attacker who obtained a stored digest, for example from a leaked users file or backup, can authenticate with the digest instead of the password. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
Severity
No CVSS data available.
CWE
- CWE-836 - Use of Password Hash Instead of Password for Authentication
Assigner
apache
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://lists.apache.org/thread/47svr3bg4lchzlhkl… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache TomEE |
Affected:
8.0.0-M2 , < 10.0.0-M1
(semver)
Affected: 10.0.0-M1 , < 10.3.0 (semver) Affected: 11.0.0-M1 , < 11.0.0-M2 (semver) |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.tomee:tomee-security",
"packageURL": "pkg:maven/org.apache.tomee/tomee-security",
"product": "Apache TomEE",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "10.0.0-M1",
"status": "affected",
"version": "8.0.0-M2",
"versionType": "semver"
},
{
"lessThan": "10.3.0",
"status": "affected",
"version": "10.0.0-M1",
"versionType": "semver"
},
{
"lessThan": "11.0.0-M2",
"status": "affected",
"version": "11.0.0-M1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "The Apache Software Foundation"
},
{
"lang": "en",
"type": "tool",
"value": "Claude Security"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Richard Zowalla"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The Jakarta Security identity store backed by the Tomcat user database compares the supplied password with the stored value as plain text and ignores the configured credential handler. When digested passwords are stored, an attacker who obtained a stored digest, for example from a leaked users file or backup, can authenticate with the digest instead of the password. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."
}
],
"value": "The Jakarta Security identity store backed by the Tomcat user database compares the supplied password with the stored value as plain text and ignores the configured credential handler. When digested passwords are stored, an attacker who obtained a stored digest, for example from a leaked users file or backup, can authenticate with the digest instead of the password. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "low"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-836",
"description": "CWE-836 Use of Password Hash Instead of Password for Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T15:22:48.278Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/47svr3bg4lchzlhkl55g5bfykhnx48jo"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Apache TomEE: Authentication with the stored password digest in Tomcat user identity store",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-111248",
"datePublished": "2026-11-10T15:22:48.278Z",
"dateReserved": "2026-10-15T18:36:39.318Z",
"dateUpdated": "2026-11-10T15:22:48.278Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111249 (GCVE-0-2026-111249)
Vulnerability from cvelistv5 – Published: 2026-11-10 15:22 – Updated: 2026-11-10 15:22
VLAI
EPSS
VEX
Title
Apache TomEE: Unauthenticated LiveReload endpoint reachable from the network
Summary
The development-time LiveReload support listens on all network interfaces without authentication and accepts websocket connections from any origin. A network attacker, or a web page visited by the developer, can observe the names of changed files in the watched folder and the server version, and reach the deployed applications through the additional port. This only affects LiveReload enabled in the embedded Maven plugin. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
Severity
No CVSS data available.
CWE
- CWE-1327 - Binding to an Unrestricted IP Address
Assigner
apache
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://lists.apache.org/thread/sssq84vj136dz964j… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache TomEE |
Affected:
7.0.0-M2 , < 10.0.0-M1
(semver)
Affected: 10.0.0-M1 , < 10.3.0 (semver) Affected: 11.0.0-M1 , < 11.0.0-M2 (semver) |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.tomee:livereload-tomee",
"packageURL": "pkg:maven/org.apache.tomee/livereload-tomee",
"product": "Apache TomEE",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "10.0.0-M1",
"status": "affected",
"version": "7.0.0-M2",
"versionType": "semver"
},
{
"lessThan": "10.3.0",
"status": "affected",
"version": "10.0.0-M1",
"versionType": "semver"
},
{
"lessThan": "11.0.0-M2",
"status": "affected",
"version": "11.0.0-M1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "The Apache Software Foundation"
},
{
"lang": "en",
"type": "tool",
"value": "Claude Security"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Richard Zowalla"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The development-time LiveReload support listens on all network interfaces without authentication and accepts websocket connections from any origin. A network attacker, or a web page visited by the developer, can observe the names of changed files in the watched folder and the server version, and reach the deployed applications through the additional port. This only affects LiveReload enabled in the embedded Maven plugin. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."
}
],
"value": "The development-time LiveReload support listens on all network interfaces without authentication and accepts websocket connections from any origin. A network attacker, or a web page visited by the developer, can observe the names of changed files in the watched folder and the server version, and reach the deployed applications through the additional port. This only affects LiveReload enabled in the embedded Maven plugin. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "low"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1327",
"description": "CWE-1327 Binding to an Unrestricted IP Address",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T15:22:18.798Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/sssq84vj136dz964j1ooyr20jc9s6pnm"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Apache TomEE: Unauthenticated LiveReload endpoint reachable from the network",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-111249",
"datePublished": "2026-11-10T15:22:18.798Z",
"dateReserved": "2026-10-15T18:36:39.603Z",
"dateUpdated": "2026-11-10T15:22:18.798Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111250 (GCVE-0-2026-111250)
Vulnerability from cvelistv5 – Published: 2026-11-10 15:21 – Updated: 2026-11-10 15:21
VLAI
EPSS
VEX
Title
Apache TomEE: Authentication bypass via programmatic authentication in embedded HTTP server
Summary
The embedded OpenEJB HTTP server reports every request as authenticated when an application requests authentication programmatically. A remote unauthenticated attacker can access functionality protected this way. Only applications served by the embedded HTTP server that rely on programmatic authentication are affected. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions.
Severity
No CVSS data available.
CWE
- CWE-287 - Improper Authentication
Assigner
apache
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://lists.apache.org/thread/yr5sbbmyym2zfoho8… | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache TomEE |
Affected:
4.0.0-beta-1 , ≤ 4.7.5
(semver)
|
|
| Apache Software Foundation | Apache TomEE |
Affected:
7.0.0-M1 , < 10.0.0-M1
(semver)
Affected: 10.0.0-M1 , ≤ 10.2.0 (semver) Affected: 11.0.0-M1 (semver) |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.openejb:openejb-http",
"packageURL": "pkg:maven/org.apache.openejb/openejb-http",
"product": "Apache TomEE",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "4.7.5",
"status": "affected",
"version": "4.0.0-beta-1",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.tomee:openejb-http",
"packageURL": "pkg:maven/org.apache.tomee/openejb-http",
"product": "Apache TomEE",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "10.0.0-M1",
"status": "affected",
"version": "7.0.0-M1",
"versionType": "semver"
},
{
"lessThanOrEqual": "10.2.0",
"status": "affected",
"version": "10.0.0-M1",
"versionType": "semver"
},
{
"status": "affected",
"version": "11.0.0-M1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "The Apache Software Foundation"
},
{
"lang": "en",
"type": "tool",
"value": "Claude Security"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Richard Zowalla"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The embedded OpenEJB HTTP server reports every request as authenticated when an application requests authentication programmatically. A remote unauthenticated attacker can access functionality protected this way. Only applications served by the embedded HTTP server that rely on programmatic authentication are affected. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions."
}
],
"value": "The embedded OpenEJB HTTP server reports every request as authenticated when an application requests authentication programmatically. A remote unauthenticated attacker can access functionality protected this way. Only applications served by the embedded HTTP server that rely on programmatic authentication are affected. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287 Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T15:21:32.361Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/yr5sbbmyym2zfoho8qv3yxshoztqjk6k"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Apache TomEE: Authentication bypass via programmatic authentication in embedded HTTP server",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-111250",
"datePublished": "2026-11-10T15:21:32.361Z",
"dateReserved": "2026-10-15T18:36:39.888Z",
"dateUpdated": "2026-11-10T15:21:32.361Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111251 (GCVE-0-2026-111251)
Vulnerability from cvelistv5 – Published: 2026-11-10 15:20 – Updated: 2026-11-10 15:20
VLAI
EPSS
VEX
Title
Apache TomEE: Unauthenticated server shutdown via the admin port
Summary
The admin service of the standalone OpenEJB server accepts stop requests without any authentication. Any local user or process able to connect to the admin port can stop the server, leading to denial of service; the admin service is enabled by default in the standalone server and bound to the loopback interface. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
Severity
No CVSS data available.
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
apache
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://lists.apache.org/thread/btc4jq3k20xysf7kq… | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache TomEE |
Affected:
4.0.0-beta-1 , ≤ 4.7.5
(semver)
|
|
| Apache Software Foundation | Apache TomEE |
Affected:
7.0.0-M1 , < 10.0.0-M1
(semver)
Affected: 10.0.0-M1 , < 10.3.0 (semver) Affected: 11.0.0-M1 , < 11.0.0-M2 (semver) |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.openejb:openejb-server",
"packageURL": "pkg:maven/org.apache.openejb/openejb-server",
"product": "Apache TomEE",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "4.7.5",
"status": "affected",
"version": "4.0.0-beta-1",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.tomee:openejb-server",
"packageURL": "pkg:maven/org.apache.tomee/openejb-server",
"product": "Apache TomEE",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "10.0.0-M1",
"status": "affected",
"version": "7.0.0-M1",
"versionType": "semver"
},
{
"lessThan": "10.3.0",
"status": "affected",
"version": "10.0.0-M1",
"versionType": "semver"
},
{
"lessThan": "11.0.0-M2",
"status": "affected",
"version": "11.0.0-M1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "The Apache Software Foundation"
},
{
"lang": "en",
"type": "tool",
"value": "Claude Security"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Richard Zowalla"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The admin service of the standalone OpenEJB server accepts stop requests without any authentication. Any local user or process able to connect to the admin port can stop the server, leading to denial of service; the admin service is enabled by default in the standalone server and bound to the loopback interface. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."
}
],
"value": "The admin service of the standalone OpenEJB server accepts stop requests without any authentication. Any local user or process able to connect to the admin port can stop the server, leading to denial of service; the admin service is enabled by default in the standalone server and bound to the loopback interface. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T15:20:26.021Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/btc4jq3k20xysf7kqsyyt7jg74v8768s"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Apache TomEE: Unauthenticated server shutdown via the admin port",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-111251",
"datePublished": "2026-11-10T15:20:26.021Z",
"dateReserved": "2026-10-15T18:36:40.174Z",
"dateUpdated": "2026-11-10T15:20:26.021Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111256 (GCVE-0-2026-111256)
Vulnerability from cvelistv5 – Published: 2026-11-10 15:20 – Updated: 2026-11-10 15:20
VLAI
EPSS
VEX
Title
Apache TomEE: Missing authentication for web service endpoints in embedded HTTP server
Summary
When JAX-WS or JAX-RS endpoints are published by the embedded OpenEJB HTTP server rather than Tomcat, some configured authentication methods are silently ignored and the endpoint is published without authentication. A remote unauthenticated attacker can invoke the exposed operations without credentials. Only deployments that use the embedded HTTP server and rely on such an authentication method are affected. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions.
Severity
No CVSS data available.
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
apache
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://lists.apache.org/thread/pfspkd8c0d5pxx3k0… | vendor-advisory |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache TomEE |
Affected:
4.0.0-beta-1 , ≤ 4.7.5
(semver)
|
|
| Apache Software Foundation | Apache TomEE |
Affected:
4.6.0 , ≤ 4.7.5
(semver)
|
|
| Apache Software Foundation | Apache TomEE |
Affected:
7.0.0-M1 , < 10.0.0-M1
(semver)
Affected: 10.0.0-M1 , ≤ 10.2.0 (semver) Affected: 11.0.0-M1 (semver) |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.openejb:openejb-webservices",
"packageURL": "pkg:maven/org.apache.openejb/openejb-webservices",
"product": "Apache TomEE",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "4.7.5",
"status": "affected",
"version": "4.0.0-beta-1",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.openejb:openejb-rest",
"packageURL": "pkg:maven/org.apache.openejb/openejb-rest",
"product": "Apache TomEE",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "4.7.5",
"status": "affected",
"version": "4.6.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.tomee:openejb-webservices",
"packageURL": "pkg:maven/org.apache.tomee/openejb-webservices",
"product": "Apache TomEE",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "10.0.0-M1",
"status": "affected",
"version": "7.0.0-M1",
"versionType": "semver"
},
{
"lessThanOrEqual": "10.2.0",
"status": "affected",
"version": "10.0.0-M1",
"versionType": "semver"
},
{
"status": "affected",
"version": "11.0.0-M1",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.tomee:openejb-rest",
"packageURL": "pkg:maven/org.apache.tomee/openejb-rest",
"product": "Apache TomEE",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "10.0.0-M1",
"status": "affected",
"version": "7.0.0-M1",
"versionType": "semver"
},
{
"lessThanOrEqual": "10.2.0",
"status": "affected",
"version": "10.0.0-M1",
"versionType": "semver"
},
{
"status": "affected",
"version": "11.0.0-M1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "The Apache Software Foundation"
},
{
"lang": "en",
"type": "tool",
"value": "Claude Security"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Markus Jung"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "When JAX-WS or JAX-RS endpoints are published by the embedded OpenEJB HTTP server rather than Tomcat, some configured authentication methods are silently ignored and the endpoint is published without authentication. A remote unauthenticated attacker can invoke the exposed operations without credentials. Only deployments that use the embedded HTTP server and rely on such an authentication method are affected. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions."
}
],
"value": "When JAX-WS or JAX-RS endpoints are published by the embedded OpenEJB HTTP server rather than Tomcat, some configured authentication methods are silently ignored and the endpoint is published without authentication. A remote unauthenticated attacker can invoke the exposed operations without credentials. Only deployments that use the embedded HTTP server and rely on such an authentication method are affected. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T15:20:02.341Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/pfspkd8c0d5pxx3k04vnfvrn979tz1zo"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Apache TomEE: Missing authentication for web service endpoints in embedded HTTP server",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-111256",
"datePublished": "2026-11-10T15:20:02.341Z",
"dateReserved": "2026-10-15T18:59:32.472Z",
"dateUpdated": "2026-11-10T15:20:02.341Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111257 (GCVE-0-2026-111257)
Vulnerability from cvelistv5 – Published: 2026-11-10 15:19 – Updated: 2026-11-10 15:19
VLAI
EPSS
VEX
Title
Apache TomEE: Well-known administrative credentials created at startup
Summary
With the default configuration and no users defined in the default user database, TomEE silently adds an administrative user with a well-known password at startup. A remote attacker can use these credentials to authenticate to web applications that use the default realm and grant access to any authenticated user or to the TomEE administrative role. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
Severity
No CVSS data available.
CWE
- CWE-1392 - Use of Default Credentials
Assigner
apache
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://lists.apache.org/thread/gzzn7jbzrfk8bo9tt… | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache TomEE |
Affected:
1.5.1 , ≤ 1.7.5
(semver)
|
|
| Apache Software Foundation | Apache TomEE |
Affected:
7.0.0-M1 , < 10.0.0-M1
(semver)
Affected: 10.0.0-M1 , < 10.3.0 (semver) Affected: 11.0.0-M1 , < 11.0.0-M2 (semver) |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.openejb:tomee-catalina",
"packageURL": "pkg:maven/org.apache.openejb/tomee-catalina",
"product": "Apache TomEE",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "1.7.5",
"status": "affected",
"version": "1.5.1",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.tomee:tomee-catalina",
"packageURL": "pkg:maven/org.apache.tomee/tomee-catalina",
"product": "Apache TomEE",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "10.0.0-M1",
"status": "affected",
"version": "7.0.0-M1",
"versionType": "semver"
},
{
"lessThan": "10.3.0",
"status": "affected",
"version": "10.0.0-M1",
"versionType": "semver"
},
{
"lessThan": "11.0.0-M2",
"status": "affected",
"version": "11.0.0-M1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "The Apache Software Foundation"
},
{
"lang": "en",
"type": "tool",
"value": "Claude Security"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Markus Jung"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "With the default configuration and no users defined in the default user database, TomEE silently adds an administrative user with a well-known password at startup. A remote attacker can use these credentials to authenticate to web applications that use the default realm and grant access to any authenticated user or to the TomEE administrative role. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."
}
],
"value": "With the default configuration and no users defined in the default user database, TomEE silently adds an administrative user with a well-known password at startup. A remote attacker can use these credentials to authenticate to web applications that use the default realm and grant access to any authenticated user or to the TomEE administrative role. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "important"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1392",
"description": "CWE-1392 Use of Default Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T15:19:32.452Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/gzzn7jbzrfk8bo9ttmqhr3c6q3szc5vf"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Apache TomEE: Well-known administrative credentials created at startup",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-111257",
"datePublished": "2026-11-10T15:19:32.452Z",
"dateReserved": "2026-10-15T18:59:32.765Z",
"dateUpdated": "2026-11-10T15:19:32.452Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111258 (GCVE-0-2026-111258)
Vulnerability from cvelistv5 – Published: 2026-11-10 15:19 – Updated: 2026-11-10 15:19
VLAI
EPSS
VEX
Title
Apache TomEE: Security constraint bypass via request routing
Summary
The optional request routing feature forwards requests to their configured destination without applying the security constraints of that destination or the protection of the web application's private directories. If a route copies client-controlled parts of the request path into its destination, a remote attacker can reach protected resources or read application configuration and class files. Only installations with such a routing configuration are affected. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
Severity
No CVSS data available.
CWE
- CWE-863 - Incorrect Authorization
Assigner
apache
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://lists.apache.org/thread/tr1mxp3vjk3zvc3k4… | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache TomEE |
Affected:
1.5.0 , ≤ 1.7.5
(semver)
|
|
| Apache Software Foundation | Apache TomEE |
Affected:
7.0.0-M1 , < 10.0.0-M1
(semver)
Affected: 10.0.0-M1 , < 10.3.0 (semver) Affected: 11.0.0-M1 , < 11.0.0-M2 (semver) |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.openejb:tomee-catalina",
"packageURL": "pkg:maven/org.apache.openejb/tomee-catalina",
"product": "Apache TomEE",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "1.7.5",
"status": "affected",
"version": "1.5.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.tomee:tomee-catalina",
"packageURL": "pkg:maven/org.apache.tomee/tomee-catalina",
"product": "Apache TomEE",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "10.0.0-M1",
"status": "affected",
"version": "7.0.0-M1",
"versionType": "semver"
},
{
"lessThan": "10.3.0",
"status": "affected",
"version": "10.0.0-M1",
"versionType": "semver"
},
{
"lessThan": "11.0.0-M2",
"status": "affected",
"version": "11.0.0-M1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "The Apache Software Foundation"
},
{
"lang": "en",
"type": "tool",
"value": "Claude Security"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Markus Jung"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The optional request routing feature forwards requests to their configured destination without applying the security constraints of that destination or the protection of the web application\u0027s private directories. If a route copies client-controlled parts of the request path into its destination, a remote attacker can reach protected resources or read application configuration and class files. Only installations with such a routing configuration are affected. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."
}
],
"value": "The optional request routing feature forwards requests to their configured destination without applying the security constraints of that destination or the protection of the web application\u0027s private directories. If a route copies client-controlled parts of the request path into its destination, a remote attacker can reach protected resources or read application configuration and class files. Only installations with such a routing configuration are affected. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T15:19:06.357Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/tr1mxp3vjk3zvc3k45ocz52ctg7wng9m"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Apache TomEE: Security constraint bypass via request routing",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-111258",
"datePublished": "2026-11-10T15:19:06.357Z",
"dateReserved": "2026-10-15T18:59:33.109Z",
"dateUpdated": "2026-11-10T15:19:06.357Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111259 (GCVE-0-2026-111259)
Vulnerability from cvelistv5 – Published: 2026-11-10 15:18 – Updated: 2026-11-10 15:18
VLAI
EPSS
VEX
Title
Apache TomEE: Predictable HTTP session identifiers in embedded server
Summary
The embedded server generates HTTP session identifiers with a non-cryptographic random number generator by default. A remote attacker who observes a session identifier can predict the identifiers issued to other users and hijack their sessions, if the application relies on HTTP sessions for authentication. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
Severity
No CVSS data available.
CWE
- CWE-338 - Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Assigner
apache
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://lists.apache.org/thread/1sk4193kxtf18q2so… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache TomEE |
Affected:
7.0.0-M1 , < 10.0.0-M1
(semver)
Affected: 10.0.0-M1 , < 10.3.0 (semver) Affected: 11.0.0-M1 , < 11.0.0-M2 (semver) |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.tomee:tomee-embedded",
"packageURL": "pkg:maven/org.apache.tomee/tomee-embedded",
"product": "Apache TomEE",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "10.0.0-M1",
"status": "affected",
"version": "7.0.0-M1",
"versionType": "semver"
},
{
"lessThan": "10.3.0",
"status": "affected",
"version": "10.0.0-M1",
"versionType": "semver"
},
{
"lessThan": "11.0.0-M2",
"status": "affected",
"version": "11.0.0-M1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "The Apache Software Foundation"
},
{
"lang": "en",
"type": "tool",
"value": "Claude Security"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Markus Jung"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The embedded server generates HTTP session identifiers with a non-cryptographic random number generator by default. A remote attacker who observes a session identifier can predict the identifiers issued to other users and hijack their sessions, if the application relies on HTTP sessions for authentication. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."
}
],
"value": "The embedded server generates HTTP session identifiers with a non-cryptographic random number generator by default. A remote attacker who observes a session identifier can predict the identifiers issued to other users and hijack their sessions, if the application relies on HTTP sessions for authentication. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-338",
"description": "CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T15:18:07.791Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/1sk4193kxtf18q2so25c62c2b73o94lg"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Apache TomEE: Predictable HTTP session identifiers in embedded server",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-111259",
"datePublished": "2026-11-10T15:18:07.791Z",
"dateReserved": "2026-10-15T18:59:33.398Z",
"dateUpdated": "2026-11-10T15:18:07.791Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111260 (GCVE-0-2026-111260)
Vulnerability from cvelistv5 – Published: 2026-11-10 15:15 – Updated: 2026-11-10 15:15
VLAI
EPSS
VEX
Title
Apache TomEE: Predictable OpenID Connect state and nonce values
Summary
The Jakarta Security OpenID Connect authentication mechanism generates the state and nonce values with a non-cryptographic random number generator and insufficient entropy. A remote attacker who predicts these values can forge an authentication callback that logs a victim into the attacker's account, and the replay protection for ID tokens is weakened. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
Severity
No CVSS data available.
CWE
- CWE-338 - Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Assigner
apache
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://lists.apache.org/thread/y6oscfyggkdf5hrj5… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache TomEE |
Affected:
10.0.0-M2 , < 10.3.0
(semver)
Affected: 11.0.0-M1 , < 11.0.0-M2 (semver) |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.tomee:tomee-security",
"packageURL": "pkg:maven/org.apache.tomee/tomee-security",
"product": "Apache TomEE",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "10.3.0",
"status": "affected",
"version": "10.0.0-M2",
"versionType": "semver"
},
{
"lessThan": "11.0.0-M2",
"status": "affected",
"version": "11.0.0-M1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "The Apache Software Foundation"
},
{
"lang": "en",
"type": "tool",
"value": "Claude Security"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Markus Jung"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The Jakarta Security OpenID Connect authentication mechanism generates the state and nonce values with a non-cryptographic random number generator and insufficient entropy. A remote attacker who predicts these values can forge an authentication callback that logs a victim into the attacker\u0027s account, and the replay protection for ID tokens is weakened. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."
}
],
"value": "The Jakarta Security OpenID Connect authentication mechanism generates the state and nonce values with a non-cryptographic random number generator and insufficient entropy. A remote attacker who predicts these values can forge an authentication callback that logs a victim into the attacker\u0027s account, and the replay protection for ID tokens is weakened. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "low"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-338",
"description": "CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T15:15:35.099Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/y6oscfyggkdf5hrj518nl08v7l8rr40q"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Apache TomEE: Predictable OpenID Connect state and nonce values",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-111260",
"datePublished": "2026-11-10T15:15:35.099Z",
"dateReserved": "2026-10-15T18:59:33.677Z",
"dateUpdated": "2026-11-10T15:15:35.099Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}