CVE-2026-111245 Apache TomEE: Privilege escalation via WS-Security caller identity leaking between requests

After a successful WS-Security UsernameToken authentication, the caller identity stays associated with the worker thread once the request completes when web services are served by the standalone OpenEJB HTTP server. A remote unauthenticated attacker whose request is later processed on the same...

CVE-2026-111245

The Apache TomEE standalone OpenEJB HTTP server is vulnerable to privilege escalation due to WS-Security caller identity leaking between requests. After a successful WS-Security UsernameToken authentication, the caller identity remains associated with the worker thread even after the request fini...

EUVD-2026-121245

After a successful WS-Security UsernameToken authentication, the caller identity stays associated with the worker thread once the request completes when web services are served by the standalone OpenEJB HTTP server. A remote unauthenticated attacker whose request is later processed on the same...

CVE-2026-111245: Apache Software Foundation Apache TomEE: After a successful WS-Security UsernameToken authentication, the caller identity stays associated with the worker…

After a successful WS-Security UsernameToken authentication, the caller identity stays associated with the worker thread once the request completes when web services are served by the standalone OpenEJB HTTP server. A remote unauthenticated attacker whose request is later processed on the same...

PT-2026-141727

After a successful WS-Security UsernameToken authentication, the caller identity stays associated with the worker thread once the request completes when web services are served by the standalone OpenEJB HTTP server. A remote unauthenticated attacker whose request is later processed on the same...

CLSA-2026-1794177052 TuxCare security update for org.springframework.ws:spring-ws-security (1 CVE)

TuxCare rebuilt org.springframework.ws:spring-ws-security to address 1 CVE. Fixed in 3.1.5-tuxcare.4...

CLSA-2026-1794176371 TuxCare security update for org.springframework.ws:spring-ws-security (1 CVE)

TuxCare rebuilt org.springframework.ws:spring-ws-security to address 1 CVE. Fixed in 3.1.4-tuxcare.4...

Important: Red Hat Security Advisory: Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.4.SP3)

An update for Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available RHBQ 3.33.4.SP3. The purpose of this text-only errata is to inform you about the enhancements that improve your developer experience and ensure the security and stability of your products. Red Hat Product...

CVE-2026-85532

A flaw was found in Apache WSS4J. A remote attacker can exploit this issue by sending crafted Web Services Security WS-Security messages containing derived-key lengths and offsets without adequate bounds. Successful exploitation can lead to a Denial of Service DoS through excessive CPU and memory...

RHLW-2026-422078E03066E6AC Lightwell Security Advisory: wss4j-ws-security-stax 4.0.1.rhlw-00003

Red Hat Lightwell has released org.apache.wss4j:wss4j-ws-security-stax 4.0.1.rhlw-00003 with a backported security fix. CVE-2026-92121: In the WSS4J streaming StAX code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" flag permanently set. The...

Improper Authentication

Overview org.apache.cxf:cxf-rt-ws-security is a services framework that helps you build and develop services using frontend programming APIs, like JAX-WS and JAX-RS. Affected versions of this package are vulnerable to Improper Authentication due to the STSTokenValidator token-validation cache in...

com.axonivy.ivy.tool.soap:cxf-client-codegen (2.0.0), io.camelbee:camelbee-quarkus-core (3.2.1) +52 more potentially affected by CVE-2026-97468 via org.apache.cxf:cxf-rt-ws-security (>=4.2.0, <=4.2.3)

org.apache.cxf:cxf-rt-ws-security MAVEN version =4.2.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =4.0.0.beta1 and more Source cves: CVE-2026-97468 Source advisory: SNYK:JAVA-ORGAPACHECXF-21245928...

com.codinglair.taf:taf-api-soap (>=1.0.0, <=1.3.0), cv.igrp:igrp-core (>=2.0.0.231123-rc1, <=2.0.0.240307-rc2) +115 more potentially affected by CVE-2026-97468 via org.apache.cxf:cxf-rt-ws-security (>=4.0.0, <=4.1.8)

org.apache.cxf:cxf-rt-ws-security MAVEN version =4.0.0, =1.0.0, =2.0.0.231123-rc1, =4.0.2, =2.4.0, =1.3, =1.3, =1.3, =1.3, =1.3, =2.0.0.alpha1, =2.7.0.cr1, =3.8.0, =2.0.0.alpha1, =2.2.4, =3.33.14 - io.quarkiverse.cxf:quarkus-cxf-integration-test-ws-security-policy-fips 3.8.1 and more Source cves:...

cloud.altemista.fwk.framework:cloud-altemistafwk-documentation (3.1.0.release), cloud.altemista.fwk.soap:cloud-altemistafwk-core-soap-wss (>=3.0.0.release, <=3.1.0.release) +299 more potentially affected by CVE-2026-97791 via org.apache.cxf:cxf-rt-ws-security (>=3.0.0-milestone1, <=3.6.12)

org.apache.cxf:cxf-rt-ws-security MAVEN version =3.0.0-milestone1, =3.0.0.release, =3.0.0.release, =3.0.0.release, =3.0.0.release, =1.0.0, =1.0.0, =1.2.0, =1.4.0, =4.2.0.1, =1.7.2.230613, =1.7.3.230802 and more Source cves: CVE-2026-97791 Source advisory: MEND:CVE-2026-97791...

com.codinglair.taf:taf-api-soap (>=1.0.0, <=1.3.0), de.governikus.panstar.sdk:panstar-soap-sdk (>=4.1.0, <=4.2.0) +85 more potentially affected by CVE-2026-97791 via org.apache.cxf:cxf-rt-ws-security (>=4.1.0, <=4.1.8)

org.apache.cxf:cxf-rt-ws-security MAVEN version =4.1.0, =1.0.0, =4.1.0, =2.5.0, =1.3, =1.3, =1.3, =1.3, =1.3, =3.18.0, =3.18.0, =3.18.0, =3.18.0, =3.18.0, =3.18.0, =3.18.0, =3.33.14 and more Source cves: CVE-2026-97791 Source advisory: MEND:CVE-2026-97791...

com.axonivy.ivy.tool.soap:cxf-client-codegen (2.0.0), io.camelbee:camelbee-quarkus-core (3.2.1) +52 more potentially affected by CVE-2026-97791 via org.apache.cxf:cxf-rt-ws-security (>=4.2.0, <=4.2.3)

org.apache.cxf:cxf-rt-ws-security MAVEN version =4.2.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =4.0.0.beta1 and more Source cves: CVE-2026-97791 Source advisory: MEND:CVE-2026-97791...

com.axonivy.ivy.tool.soap:cxf-client-codegen (2.0.0), io.camelbee:camelbee-quarkus-core (3.2.1) +52 more potentially affected by CVE-2026-97468 via org.apache.cxf:cxf-rt-ws-security (>=4.2.0, <=4.2.3)

org.apache.cxf:cxf-rt-ws-security MAVEN version =4.2.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =4.0.0.beta1 and more Source cves: CVE-2026-97468 Source advisory: MEND:CVE-2026-97468...

br.com.esec.icpm:certillion-client-library (>=1.1.7, <=1.2.0), br.com.esec.icpm:certillion-client-library-resteasy-plugin (>=1.1.9, <=1.1.10) +364 more potentially affected by CVE-2026-97468 via org.apache.cxf:cxf-rt-ws-security (>=2.1.10, <=3.6.12)

org.apache.cxf:cxf-rt-ws-security MAVEN version =2.1.10, =1.1.7, =1.1.9, =1.2.5, =3.0.0.release, =3.0.0.release, =3.0.0.release, =3.0.0.release, =1.0.0, =1.0.0, =1.0.2, =1.0.0, =1.0.0, =1.0.0, =1.1.0 and more Source cves: CVE-2026-97468 Source advisory: MEND:CVE-2026-97468...

com.codinglair.taf:taf-api-soap (>=1.0.0, <=1.3.0), cv.igrp:igrp-core (>=2.0.0.231123-rc1, <=2.0.0.240307-rc2) +115 more potentially affected by CVE-2026-97468 via org.apache.cxf:cxf-rt-ws-security (>=4.0.0, <=4.1.8)

org.apache.cxf:cxf-rt-ws-security MAVEN version =4.0.0, =1.0.0, =2.0.0.231123-rc1, =4.0.2, =2.4.0, =1.3, =1.3, =1.3, =1.3, =1.3, =2.0.0.alpha1, =2.7.0.cr1, =3.8.0, =2.0.0.alpha1, =2.2.4, =3.33.14 - io.quarkiverse.cxf:quarkus-cxf-integration-test-ws-security-policy-fips 3.8.1 and more Source cves:...

com.axonivy.ivy.tool.soap:cxf-client-codegen (2.0.0), com.codinglair.taf:taf-api-soap (>=1.0.0, <=1.3.0) +156 more potentially affected by CVE-2026-85532 via org.apache.wss4j:wss4j-ws-security-common (>=4.0.0, <=4.0.1)

org.apache.wss4j:wss4j-ws-security-common MAVEN version =4.0.0, =1.0.0, =0.9.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.4.0, =4.0.0, =4.0.0, =4.0.0, =4.0.2, =4.0.2, =4.7.0 and more Source cves: CVE-2026-85532 Source advisory: SNYK:JAVA-ORGAPACHEWSS4J-21716526...