{"id":"CVE-2026-110003","kind":"vulnerability","aliases":["CVE-2026-110003"],"related":[],"title":"Payara Server: admin REST X-GlassFish-authToken header bypasses authentication (empty-password default domains)","description":"A vulnerability in the administration REST interface of Azul Payara allows a remote, unauthenticated attacker to bypass secure-admin remote-access restrictions by supplying an arbitrary value in the X-GlassFish-authToken HTTP header. The header's presence waives the remote-rejection check before the token is validated, and an invalid token falls through to password-based authentication, which succeeds without credentials on default domains configured with an empty administrative password. Successful exploitation grants execution of arbitrary administrative commands, equivalent to complete compromise of the server.","summary":"The administration REST interface of Azul Payara trusts a supplied X-GlassFish-authToken header, which skips the remote-access check and then falls through to password login. On default domains with an empty admin password, a remote attacker with no credentials can run arbitrary administrative commands and fully compromise the server.","severity":"critical","cvss":9.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Payara Server 7","fixed":["7.6.0"],"affected":">= 7.0.0, < 7.6.0","ecosystem":"runtime"},{"name":"Payara Server Community 7","fixed":["7.2026.11"],"affected":"< 7.2026.11","ecosystem":"runtime"},{"name":"Payara Server 6","fixed":["6.44.0"],"affected":">= 6.0.0, < 6.44.0","ecosystem":"runtime"},{"name":"Payara Server 5","fixed":["5.93.0"],"affected":">= 5.20.0, < 5.93.0","ecosystem":"runtime"},{"name":"Payara Server 4","fixed":["4.1.2.191.61"],"affected":">= 4.1.2.191, < 4.1.2.191.61","ecosystem":"runtime"}],"ecosystems":["runtime"],"tags":["admin-interface","application-server","java","payara","runtime","self-hosted"],"not_affected_if":["admin-interface-not-network-reachable","admin-password-set","admin-port-not-exposed","auth-required"],"how_to_check":"- Version: run 'asadmin version' (or check the install dir); affected if below the fixed version for your branch (7.0.0 to <7.6.0, 7.2024.1.Alpha1 to <7.2026.11, 6.0.0 to <6.44.0, 6.2022.1 to 6.2025.11, 5.20.0 to <5.93.0, 5.181 to 5.201.2, 5.2020.2 to 5.2022.5, 4.1.2.191 to <4.1.2.191.61).\n- Exposure: check whether the admin port (default 4848) is reachable beyond localhost, and whether secure-admin is enabled.\n- Empty password: the advisory says the unauthenticated path succeeds on default domains with an empty admin password; check with 'asadmin list-domains' / try 'asadmin --host <h> list-applications' without a password. Domains with a set admin password are not stated to be exploitable by this route; patch anyway.","fix":"Upgrade to Azul Payara 7.6.0 (Enterprise 7), 7.2026.11 (Community 7), 6.44.0 (6), 5.93.0 (5) or 4.1.2.191.61 (4). Until patched, do not expose the admin port (4848) to the network and set a non-empty admin password.","status":"open","published_at":"2026-11-12T09:16:39+00:00","first_seen_at":"2026-11-12T09:37:34+00:00","triaged_at":"2026-11-12T09:39:11+00:00","updated_at":"2026-11-12T09:40:44+00:00","category":"runtime","confidence":0.85,"triage":{"at":"2026-11-12T09:39:11Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Payara: admin REST header bypass gives unauthenticated full server control","impact":"high","summary":"The administration REST interface of Azul Payara trusts a supplied X-GlassFish-authToken header, which skips the remote-access check and then falls through to password login. On default domains with an empty admin password, a remote attacker with no credentials can run arbitrary administrative commands and fully compromise the server.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["payara","java","self-hosted","application-server"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Remote attacker runs arbitrary administrative commands, fully compromising the server","analyst_note":"Find the fixed Payara versions and the vendor advisory for CVE-2026-110003 on the NVD page, and confirm the default-domain and empty-password conditions.","how_to_check":"- Check whether the admin console or REST interface is reachable from the network, for example by inspecting firewall rules or the `secure-admin` settings in the domain configuration.\n- Check whether the administrative password on each domain is empty, using the Payara domain configuration.\n- Check the installed Payara version against the ranges in the NVD record.","plain_action":"","product_name":"Payara","needs_analyst":true,"not_affected_if":["admin-interface-not-network-reachable","admin-password-set"],"who_is_affected":"Servers running Azul Payara whose administration REST interface is reachable from a network, and whose domain has an empty administrative password. Deployments where the admin interface is restricted to localhost or behind a network boundary with a set administrative password are less exposed, but the sources do not state exact exposure conditions.","user_interaction":"no","product_ecosystem":"runtime","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000787,"input_tokens":4637,"output_tokens":647,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the fixed Payara versions and the vendor advisory for CVE-2026-110003 on the NVD page, and confirm the default-domain and empty-password conditions.","search":"'-110003':19A,22A '-2026':18A,21A '4':38A '5':35A '6':32A '7':25A,29A 'access':71B,126C 'admin':3A,40B,86B,123C 'admin-interfac':39B 'administr':52B,97B,108C,178C,186C 'allow':114C 'applic':43B 'application-serv':42B 'arbitrari':96B,131C,185C 'attack':90B,118C 'authent':11A,166C 'authtoken':8A,64B,138C 'azul':56B,112C 'base':165C 'bypass':10A,120C 'check':72B,150C 'command':98B,187C 'community':28A 'complet':190C 'compromis':101B,191C 'configur':174C 'credenti':93B,170C 'cve':17A,20A 'default':15A,81B,172C 'domain':16A,82B,173C 'empti':13A,85B,177C 'empty-password':12A 'equival':188C 'execut':183C 'exploit':181C 'fall':75B,160C 'fulli':100B 'glassfish':7A,63B,137C 'grant':182C 'header':9A,65B,140C,142C 'host':50B 'http':139C 'interfac':41B,54B,110C 'invalid':158C 'java':45B 'login':79B 'password':14A,78B,87B,164C,179C 'password-bas':163C 'payara':1A,23A,26A,30A,33A,36A,46B,57B,113C 'presenc':144C 'reject':149C 'remot':70B,89B,116C,125C,148C 'remote-access':69B,124C 'remote-reject':147C 'rest':4A,53B,109C 'restrict':127C 'run':95B 'runtim':47B 'secur':122C 'secure-admin':121C 'self':49B 'self-host':48B 'server':2A,24A,27A,31A,34A,37A,44B,103B,194C 'skip':67B 'succeed':168C 'success':180C 'suppli':60B,129C 'token':153C,159C 'trust':58B 'unauthent':117C 'valid':155C 'valu':132C 'vulner':105C 'waiv':145C 'without':169C 'x':6A,62B,136C 'x-glassfish-authtoken':5A,61B,135C","nicknames":[],"mitigations":[],"who_affected":"Any Azul Payara Server (Enterprise or Community) on the listed 4.x to 7.x branches whose administration REST interface (admin port, default 4848) can be reached over the network. Per the vendor's CNA record, the bypass turns into full unauthenticated command execution on default domains with an empty administrative password. Skip if the admin interface is only reachable from localhost or trusted networks and the admin password is set, but still upgrade.","tier":"B","verified":{"fix":{"at":"2026-11-12T09:40:44Z","by":"analyst","doc":"https://github.com/payara/Payara/releases/tag/payara-server-7.2026.11","run_id":3723},"products":{"at":"2026-11-12T09:40:44Z","by":"analyst","doc":"https://github.com/payara/Payara/releases/tag/payara-server-7.2026.11","run_id":3723},"who_affected":{"at":"2026-11-12T09:40:44Z","by":"analyst","doc":"https://github.com/payara/Payara/releases/tag/payara-server-7.2026.11","run_id":3723}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["payaraserver4","payaraserver5","payaraserver6","payaraserver7","payaraservercommunity7","server4","server5","server6","server7","servercommunity7"],"ptokens":["community","payara","server"],"labels":["admininterface","applicationserver","critical","java","payara","runtime","selfhosted"],"campaign_type":null,"search_a":"'-110003':19A,22A '-2026':18A,21A '4':38A '5':35A '6':32A '7':25A,29A 'admin':3A 'authent':11A 'authtoken':8A 'bypass':10A 'community':28A 'cve':17A,20A 'default':15A 'domain':16A 'empti':13A 'empty-password':12A 'glassfish':7A 'header':9A 'password':14A 'payara':1A,23A,26A,30A,33A,36A 'rest':4A 'server':2A,24A,27A,31A,34A,37A 'x':6A 'x-glassfish-authtoken':5A","search_b":"'access':71B 'admin':40B,86B 'admin-interfac':39B 'administr':52B,97B 'applic':43B 'application-serv':42B 'arbitrari':96B 'attack':90B 'authtoken':64B 'azul':56B 'check':72B 'command':98B 'compromis':101B 'credenti':93B 'default':81B 'domain':82B 'empti':85B 'fall':75B 'fulli':100B 'glassfish':63B 'header':65B 'host':50B 'interfac':41B,54B 'java':45B 'login':79B 'password':78B,87B 'payara':46B,57B 'remot':70B,89B 'remote-access':69B 'rest':53B 'run':95B 'runtim':47B 'self':49B 'self-host':48B 'server':44B,103B 'skip':67B 'suppli':60B 'trust':58B 'x':62B 'x-glassfish-authtoken':61B","search_c":"'access':126C 'admin':123C 'administr':108C,178C,186C 'allow':114C 'arbitrari':131C,185C 'attack':118C 'authent':166C 'authtoken':138C 'azul':112C 'base':165C 'bypass':120C 'check':150C 'command':187C 'complet':190C 'compromis':191C 'configur':174C 'credenti':170C 'default':172C 'domain':173C 'empti':177C 'equival':188C 'execut':183C 'exploit':181C 'fall':160C 'glassfish':137C 'grant':182C 'header':140C,142C 'http':139C 'interfac':110C 'invalid':158C 'password':164C,179C 'password-bas':163C 'payara':113C 'presenc':144C 'reject':149C 'remot':116C,125C,148C 'remote-access':124C 'remote-reject':147C 'rest':109C 'restrict':127C 'secur':122C 'secure-admin':121C 'server':194C 'succeed':168C 'success':180C 'suppli':129C 'token':153C,159C 'unauthent':117C 'valid':155C 'valu':132C 'vulner':105C 'waiv':145C 'without':169C 'x':136C 'x-glassfish-authtoken':135C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T09:16:39+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"769c9ae7-73c3-4e47-ae19-903170fc3eb8","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110003","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110003","severity":null,"published_at":"2026-11-12T09:16:39+00:00","modified_at":"2026-11-12T09:16:39+00:00","first_seen_at":"2026-11-12T09:37:34+00:00","fetched_at":"2026-11-12T09:37:34+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-110003:3723","url":"https://cveawg.mitre.org/api/cve/CVE-2026-110003","severity":null,"published_at":"2026-11-12T09:40:44+00:00","modified_at":"2026-11-12T09:40:44+00:00","first_seen_at":"2026-11-12T09:40:44+00:00","fetched_at":"2026-11-12T09:40:44+00:00","note":"Read Payara's own CNA record (cveawg) plus Azul release notes 7.6.0 and 5.93.0 and Community 7.2026.11 GitHub release; all list FISH-14855 under Security Fixes. Release notes do not name the CVE id; fixed versions come from the CNA record's references. 4.x and 6.x release notes not read. NVD page returned empty. No exploitation or PoC found; X not checked.","cites":["https://cveawg.mitre.org/api/cve/CVE-2026-110003","https://docs.azul.com/payara/release-notes/release-notes-7.6.0.html","https://docs.azul.com/payara/version/5/release-notes/release-notes-5.93.0.html","https://github.com/payara/Payara/releases/tag/payara-server-7.2026.11"]}],"documents":[{"id":133706,"url":"https://cveawg.mitre.org/api/cve/CVE-2026-110003","title":"CVE-2026-110003 CNA record (Payara)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":133701,"url":"https://docs.azul.com/payara/release-notes/release-notes-7.6.0.html","title":"Azul Payara 7.6.0 release notes","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":133703,"url":"https://docs.azul.com/payara/version/5/release-notes/release-notes-5.93.0.html","title":"Azul Payara 5.93.0 release notes","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":133709,"url":"https://github.com/payara/Payara/releases/tag/payara-server-7.2026.11","title":"Payara Community 7.2026.11","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}