CVE-2026-111257

Not scored yetLast modified Nov 10, 2026

Description

With the default configuration and no users defined in the default user database, TomEE silently adds an administrative user with a well-known password at startup. A remote attacker can use these credentials to authenticate to web applications that use the default realm and grant access to any authenticated user or to the TomEE administrative role. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.

Metrics

No CVSS score has been published yet.

Weakness enumeration

CWE-1392

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
Apache Software FoundationApache TomEE>= 1.5.1, <= 1.7.5
Apache Software FoundationApache TomEE>= 7.0.0-M1, < 10.0.0-M1; >= 10.0.0-M1, < 10.3.0; >= 11.0.0-M1, < 11.0.0-M2

References

Timeline

Published
Nov 10, 2026
Last modified
Nov 10, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-111258The optional request routing feature forwards requests to their configured destination without applying the security constraints of that desCVE-2026-111259The embedded server generates HTTP session identifiers with a non-cryptographic random number generator by default. A remote attacker who obCVE-2026-111264.3Inappropriate implementation in DevTools in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicCVE-2026-111260The Jakarta Security OpenID Connect authentication mechanism generates the state and nonce values with a non-cryptographic random number genCVE-2026-111261The Jakarta Security LDAP identity store accepts an empty password as valid if the directory server allows unauthenticated binds, which someCVE-2026-111262The Jakarta Security LDAP identity store does not neutralize special characters in the caller name before using it in directory queries. A rCVE-2026-111263Authentication configured for an EJB JAX-WS endpoint in the TomEE deployment descriptor is not enforced when the endpoint is published withiCVE-2026-111264The security constraint generated for EJB JAX-WS endpoints with configured authentication protects only some HTTP methods. A remote unauthenCVE-2026-1112696.1libical through 4.0.6 contains a heap-based out-of-bounds read in icalvalue_decode_ical_string() in src/libical/icalvalue.c when decoding inCVE-2026-111276.5Inappropriate implementation in WebAPKs in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to perform domain spoofCVE-2026-1112706.1libmodplug through 0.8.9.1 contains a heap-based out-of-bounds write in CSoundFile::ReadDSM() in src/load_dsm.cpp because nPat is never checCVE-2026-1112715.5libmodplug through 0.8.9.1 contains a heap-based out-of-bounds read vulnerability in CSoundFile::ReadAMS2() in src/load_ams.cpp that allows
CVE-2026-111257: Unscored | Vulnix