CVE-2026-111245 Apache TomEE: Privilege escalation via WS-Security caller identity leaking between requests

After a successful WS-Security UsernameToken authentication, the caller identity stays associated with the worker thread once the request completes when web services are served by the standalone OpenEJB HTTP server. A remote unauthenticated attacker whose request is later processed on the same...

CVE-2026-111245

The Apache TomEE standalone OpenEJB HTTP server is vulnerable to privilege escalation due to WS-Security caller identity leaking between requests. After a successful WS-Security UsernameToken authentication, the caller identity remains associated with the worker thread even after the request fini...