CVE-2026-111245 Apache TomEE: Privilege escalation via WS-Security caller identity leaking between requests

After a successful WS-Security UsernameToken authentication, the caller identity stays associated with the worker thread once the request completes when web services are served by the standalone OpenEJB HTTP server. A remote unauthenticated attacker whose request is later processed on the same...

CVE-2026-111245

The Apache TomEE standalone OpenEJB HTTP server is vulnerable to privilege escalation due to WS-Security caller identity leaking between requests. After a successful WS-Security UsernameToken authentication, the caller identity remains associated with the worker thread even after the request fini...

CVE-2026-111250: Apache Software Foundation Apache TomEE: The embedded OpenEJB HTTP server reports every request as authenticated when an application requests authentication…

The embedded OpenEJB HTTP server reports every request as authenticated when an application requests authentication programmatically. A remote unauthenticated attacker can access functionality protected this way. Only applications served by the embedded HTTP server that rely on programmatic...

CVE-2026-111246: Apache Software Foundation Apache TomEE: The embedded OpenEJB HTTP server does not isolate HTTP sessions between web applications

The embedded OpenEJB HTTP server does not isolate HTTP sessions between web applications. A remote attacker can use a session established in one web application in another one, which then trusts session state set by the first application. Only deployments hosting several web applications on the...

CVE-2026-111256: Apache Software Foundation Apache TomEE: When JAX-WS or JAX-RS endpoints are published by the embedded OpenEJB HTTP server rather than Tomcat, some configured…

When JAX-WS or JAX-RS endpoints are published by the embedded OpenEJB HTTP server rather than Tomcat, some configured authentication methods are silently ignored and the endpoint is published without authentication. A remote unauthenticated attacker can invoke the exposed operations without...

CVE-2026-111245: Apache Software Foundation Apache TomEE: After a successful WS-Security UsernameToken authentication, the caller identity stays associated with the worker…

After a successful WS-Security UsernameToken authentication, the caller identity stays associated with the worker thread once the request completes when web services are served by the standalone OpenEJB HTTP server. A remote unauthenticated attacker whose request is later processed on the same...

CVE-2026-86531: Apache Software Foundation Apache TomEE: The embedded OpenEJB HTTP server does not limit the size of incoming request bodies or of multipart requests, and does…

The embedded OpenEJB HTTP server does not limit the size of incoming request bodies or of multipart requests, and does not remove the temporary files it creates for multipart parts. A remote unauthenticated attacker can cause excessive memory or disk usage, leading to denial of service. Deploymen...

CVE-2026-97880: Apache Software Foundation Apache TomEE: The embedded OpenEJB HTTP server dispatches some requests to REST endpoints configured for HTTP Basic authentication…

The embedded OpenEJB HTTP server dispatches some requests to REST endpoints configured for HTTP Basic authentication without verifying credentials. A remote unauthenticated attacker can invoke protected resources, bypassing authentication. Only deployments that use the embedded HTTP server with...

CVE-2026-97881: Apache Software Foundation Apache TomEE: The embedded OpenEJB HTTP server does not restrict static resource paths to the configured resource directories

The embedded OpenEJB HTTP server does not restrict static resource paths to the configured resource directories. A remote unauthenticated attacker can read arbitrary files accessible to the server process. Users are recommended to block network access to the embedded HTTP server from untrusted...