CVE-2026-111246

Not scored yetLast modified Nov 12, 2026

Description

The embedded OpenEJB HTTP server does not isolate HTTP sessions between web applications. A remote attacker can use a session established in one web application in another one, which then trusts session state set by the first application. Only deployments hosting several web applications on the embedded HTTP server are affected. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions.

Metrics

No CVSS score has been published yet.

Weakness enumeration

CWE-668

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Apache Software Foundation	Apache TomEE	>= 4.5.2, <= 4.7.5
Apache Software Foundation	Apache TomEE	>= 7.0.0-M1, < 10.0.0-M1; >= 10.0.0-M1, <= 10.2.0; 11.0.0-M1

References

https://lists.apache.org/thread/3l9twg2ywvgwjffv4wwop2fmtp05fp39

Timeline

Published: Nov 10, 2026
Last modified: Nov 12, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-111247When resolving security roles of a realm-authenticated caller, the caller's user name is also treated as a role name in addition to the role CVE-2026-111248The Jakarta Security identity store backed by the Tomcat user database compares the supplied password with the stored value as plain text an CVE-2026-111249The development-time LiveReload support listens on all network interfaces without authentication and accepts websocket connections from any CVE-2026-111258.8Use after free in Compositing in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox v CVE-2026-111250The embedded OpenEJB HTTP server reports every request as authenticated when an application requests authentication programmatically. A remo CVE-2026-111251The admin service of the standalone OpenEJB server accepts stop requests without any authentication. Any local user or process able to conne CVE-2026-1112526.5A denial of service vulnerability exists in the XML parsing of multiple versions of OpenNMS Meridian and Horizon. OpenNMS parsed XML without CVE-2026-1112536.6A flaw was found in dnf5daemon-server. Session methods on dynamically exported D-Bus session objects do not verify that the caller is the un CVE-2026-1112547.2The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and CVE-2026-1112557.5The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to Arbitrary File Upload in all CVE-2026-111256When JAX-WS or JAX-RS endpoints are published by the embedded OpenEJB HTTP server rather than Tomcat, some configured authentication methods CVE-2026-111257With the default configuration and no users defined in the default user database, TomEE silently adds an administrative user with a well-kno