CVE-2026-86336

Apache TomEE running on JDK 21 or later skips EJB method authorization checks, allowing callers to invoke EJB methods without the configured access restrictions being enforced. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue...

EUVD-2026-121262

Apache TomEE running on JDK 21 or later skips EJB method authorization checks, allowing callers to invoke EJB methods without the configured access restrictions being enforced. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue...

CVE-2026-86336 Apache TomEE: EJB method authorization is silently skipped on JDK 21+

Apache TomEE running on JDK 21 or later skips EJB method authorization checks, allowing callers to invoke EJB methods without the configured access restrictions being enforced. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue...

CVE-2026-86336

Apache TomEE running on JDK 21 or later is vulnerable to a missing authorization flaw where EJB method authorization checks are silently skipped. This allows callers to invoke EJB methods without the enforcement of configured access restrictions (CWE-862 ). To remediate this issue, users are reco...

CVE-2026-86531 Apache TomEE: DoS via unbounded request body and multipart handling in embedded HTTP server

The embedded OpenEJB HTTP server does not limit the size of incoming request bodies or of multipart requests, and does not remove the temporary files it creates for multipart parts. A remote unauthenticated attacker can cause excessive memory or disk usage, leading to denial of service. Deploymen...

CVE-2026-86531

The Apache TomEE embedded OpenEJB HTTP server is vulnerable to a Denial of Service (DoS) attack because it lacks limits on the size of incoming request bodies and multipart requests. Additionally, it fails to remove temporary files created during multipart processing. A remote unauthenticated att...

CVE-2026-87758 Apache TomEE: Missing TLS hostname verification in ejbds client connections

The remote EJB client does not verify that the hostname of the server it connects to matches the server's TLS certificate. An attacker able to intercept network traffic between an EJB client and server can impersonate the server and read or modify the traffic, including credentials and invocation...

CVE-2026-87758

Apache TomEE is vulnerable to a security flaw due to missing TLS hostname verification in EJBDS client connections. The underlying cause is that the remote EJB client fails to verify if the server's hostname matches the certificate provided during the TLS handshake. This allows an attacker capabl...

CVE-2026-97849 Apache TomEE: Derby network service listens on all interfaces

The embedded Derby network service ignores its configured bind address and listens on all network interfaces. When the service is enabled, a remote attacker with network access can connect to the database server and read or modify data. Users are recommended to upgrade to version 10.3.0 or...

CVE-2026-97849

The Apache TomEE embedded Derby network service is vulnerable because it ignores its configured bind address and listens on all network interfaces. If the service is enabled, a remote attacker with network access can connect to the database server to read or modify data . Remediation involves upg...

CVE-2026-97867

Apache TomEE is vulnerable to database credential disclosure via the EJBd remote protocol . A remote client capable of reaching the EJBd endpoint can perform a JNDI lookup to retrieve datasource connection details, including sensitive database credentials. This allows an attacker to connect direc...

CVE-2026-97867 Apache TomEE: Database credential disclosure via remote JNDI lookup

The EJBd remote protocol returns datasource connection details, including database credentials, to remote clients that look up a datasource. A remote client able to reach the EJBd endpoint can obtain the database credentials and connect to the database directly. Users are recommended to upgrade t...

CVE-2026-97870 Apache TomEE: Missing authentication for Hessian endpoints in embedded HTTP server

When Hessian remoting endpoints are served by the embedded HTTP server, configured authentication and transport security requirements are silently ignored. A remote unauthenticated attacker can invoke the exposed EJB methods without credentials or over an unencrypted connection. Only deployments...

CVE-2026-97870

Apache TomEE is vulnerable to a missing authentication flaw in its embedded HTTP server when serving Hessian remoting endpoints. The vulnerability occurs because configured authentication and transport security requirements are silently ignored, allowing a remote unauthenticated attacker to invok...

CVE-2026-97872 Apache TomEE: Authentication bypass of Hessian EJB endpoints due to ignored security settings

When an EJB is exposed over the optional Hessian protocol inside an existing web application, some configured authentication and transport security settings are silently not enforced. A remote unauthenticated attacker can invoke the exposed EJB methods. Only deployments using the Hessian module...

CVE-2026-97872

In Apache TomEE , an authentication bypass exists when an EJB is exposed over the optional Hessian protocol . The vulnerability is caused by certain configured authentication and transport security settings being silently ignored, allowing a remote unauthenticated attacker to invoke exposed EJB m...

CVE-2026-97874 Apache TomEE: Authentication bypass for Hessian endpoints in non-root web applications

When Hessian remoting is configured with BASIC authentication, the authentication check is not applied to Hessian endpoints of applications deployed under a non-root context path. A remote unauthenticated attacker can invoke the exposed EJB methods without credentials. Users are recommended to...

CVE-2026-97874

Apache TomEE is vulnerable to an authentication bypass when Hessian remoting is configured with BASIC authentication . The issue occurs because authentication checks are not applied to Hessian endpoints for applications deployed under a non-root context path . This allows a remote unauthenticated...

CVE-2026-97880

The embedded OpenEJB HTTP server in Apache TomEE is vulnerable to an authentication bypass affecting REST endpoints configured with HTTP Basic authentication . The root cause is that the server dispatches certain requests to these endpoints without verifying credentials. A remote unauthenticated ...

CVE-2026-97880 Apache TomEE: Authentication bypass in the embedded HTTP server for endpoints protected by HTTP Basic authentication

The embedded OpenEJB HTTP server dispatches some requests to REST endpoints configured for HTTP Basic authentication without verifying credentials. A remote unauthenticated attacker can invoke protected resources, bypassing authentication. Only deployments that use the embedded HTTP server with...