{"id":"CVE-2026-111242","kind":"vulnerability","aliases":["CVE-2026-111242"],"related":[],"title":"MicroProfile JWT: leftover run-as identity lets later requests escalate privileges","description":"When MicroProfile JWT authentication is used for servlets that declare a run-as identity, the security state established for a request is not always cleared from the processing thread when the request does not complete normally. A remote attacker holding a valid token can cause later, unrelated requests served by the same thread to invoke enterprise beans with the elevated run-as identity. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.","summary":"When MicroProfile JWT authentication is used with servlets that declare a run-as identity, a request that does not finish normally can leave its elevated security identity on the processing thread. A remote attacker with a valid token can then make later, unrelated requests on that thread call enterprise beans with the elevated run-as identity.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["java-ee","jwt","microprofile","runtime","servlet"],"not_affected_if":["no-microprofile-jwt","no-run-as-servlets"],"how_to_check":"- Check whether the application uses MicroProfile JWT authentication together with servlets declaring `@RunAs`.\n- Check the server's version against the fixed releases listed below.","fix":"- Upgrade to `10.3.0` or `11.0.0-M2`, per the source's statement.","status":"open","published_at":"2026-11-10T16:17:14+00:00","first_seen_at":"2026-11-10T16:22:32+00:00","triaged_at":"2026-11-10T16:25:21+00:00","updated_at":"2026-11-10T16:25:21+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-11-10T16:25:21Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade to `10.3.0` or `11.0.0-M2`, per the source's statement.","reach":"internet","title":"MicroProfile JWT: leftover run-as identity lets later requests escalate privileges","impact":"high","summary":"When MicroProfile JWT authentication is used with servlets that declare a run-as identity, a request that does not finish normally can leave its elevated security identity on the processing thread. A remote attacker with a valid token can then make later, unrelated requests on that thread call enterprise beans with the elevated run-as identity.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["microprofile","jwt","servlet","java-ee"],"confidence":0.5,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker invokes enterprise beans with elevated run-as identity","analyst_note":"Identify the affected server product and its vulnerable version ranges from the NVD entry; sources give only the fixed versions 10.3.0 and 11.0.0-M2.","how_to_check":"- Check whether the application uses MicroProfile JWT authentication together with servlets declaring `@RunAs`.\n- Check the server's version against the fixed releases listed below.","plain_action":"","product_name":"unknown","needs_analyst":true,"not_affected_if":["no-microprofile-jwt","no-run-as-servlets"],"who_is_affected":"Applications that use MicroProfile JWT authentication on servlets that declare a run-as identity are exposed, because the elevated identity can persist across requests on a shared thread. Applications without MicroProfile JWT or without run-as servlets are likely not affected. The sources do not name the affected product line or the exact vulnerable version ranges.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.00078,"input_tokens":4587,"output_tokens":642,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-111242':15A,18A '-2026':14A,17A '10.3.0':156C '11.0.0':158C 'alway':108C 'attack':60B,123C 'authent':29B,87C 'bean':76B,141C 'call':74B 'caus':129C 'clear':109C 'complet':119C 'cve':13A,16A 'declar':35B,93C 'ee':21B 'elev':51B,79B,144C 'enterpris':75B,140C 'escal':11A 'establish':102C 'finish':46B 'fix':161C 'hold':124C 'ident':7A,40B,53B,83B,98C,148C 'invok':139C 'issu':163C 'java':20B 'java-e':19B 'jwt':2A,22B,28B,86C 'later':9A,68B,130C 'leav':49B 'leftov':3A 'let':8A 'm2':159C 'make':67B 'microprofil':1A,23B,27B,85C 'normal':47B,120C 'privileg':12A 'process':56B,112C 'recommend':151C 'remot':59B,122C 'request':10A,42B,70B,105C,116C,132C 'run':5A,38B,81B,96C,146C 'run-a':4A,37B,80B,95C,145C 'runtim':24B 'secur':52B,100C 'serv':133C 'servlet':25B,33B,91C 'state':101C 'thread':57B,73B,113C,137C 'token':64B,127C 'unrel':69B,131C 'upgrad':153C 'use':31B,89C 'user':149C 'valid':63B,126C 'version':155C","nicknames":[],"mitigations":[],"who_affected":"Applications that use MicroProfile JWT authentication on servlets that declare a run-as identity are exposed, because the elevated identity can persist across requests on a shared thread. Applications without MicroProfile JWT or without run-as servlets are likely not affected. The sources do not name the affected product line or the exact vulnerable version ranges.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["javaee","jwt","microprofile","runtime","servlet","unknown"],"campaign_type":null,"search_a":"'-111242':15A,18A '-2026':14A,17A 'cve':13A,16A 'escal':11A 'ident':7A 'jwt':2A 'later':9A 'leftov':3A 'let':8A 'microprofil':1A 'privileg':12A 'request':10A 'run':5A 'run-a':4A","search_b":"'attack':60B 'authent':29B 'bean':76B 'call':74B 'declar':35B 'ee':21B 'elev':51B,79B 'enterpris':75B 'finish':46B 'ident':40B,53B,83B 'java':20B 'java-e':19B 'jwt':22B,28B 'later':68B 'leav':49B 'make':67B 'microprofil':23B,27B 'normal':47B 'process':56B 'remot':59B 'request':42B,70B 'run':38B,81B 'run-a':37B,80B 'runtim':24B 'secur':52B 'servlet':25B,33B 'thread':57B,73B 'token':64B 'unrel':69B 'use':31B 'valid':63B","search_c":"'10.3.0':156C '11.0.0':158C 'alway':108C 'attack':123C 'authent':87C 'bean':141C 'caus':129C 'clear':109C 'complet':119C 'declar':93C 'elev':144C 'enterpris':140C 'establish':102C 'fix':161C 'hold':124C 'ident':98C,148C 'invok':139C 'issu':163C 'jwt':86C 'later':130C 'm2':159C 'microprofil':85C 'normal':120C 'process':112C 'recommend':151C 'remot':122C 'request':105C,116C,132C 'run':96C,146C 'run-a':95C,145C 'secur':100C 'serv':133C 'servlet':91C 'state':101C 'thread':113C,137C 'token':127C 'unrel':131C 'upgrad':153C 'use':89C 'user':149C 'valid':126C 'version':155C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T16:17:14+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111242","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111242","severity":null,"published_at":"2026-11-10T16:17:14+00:00","modified_at":"2026-11-10T16:17:14+00:00","first_seen_at":"2026-11-10T16:22:32+00:00","fetched_at":"2026-11-10T16:22:32+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}