{"id":"CVE-2026-111245","kind":"vulnerability","aliases":["CVE-2026-111245"],"related":[],"title":"OpenEJB: web service caller identity leaks to later requests on same thread","description":"After a successful WS-Security UsernameToken authentication, the caller identity stays associated with the worker thread once the request completes when web services are served by the standalone OpenEJB HTTP server. A remote unauthenticated attacker whose request is later processed on the same thread can invoke protected EJB methods with the identity of a previously authenticated user. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.","summary":"After a successful WS-Security UsernameToken login, OpenEJB's standalone HTTP server keeps the caller's identity attached to the worker thread after the request ends. A later unauthenticated request handled on that same thread can call protected EJB methods as the previously logged-in user.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"OpenEJB","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["java","openejb","runtime","web-services","ws-security"],"not_affected_if":["no-web-services","other-container"],"how_to_check":"- Check the OpenEJB version in your build files or the server's lib directory (for example `openejb-core` in `pom.xml` or `build.gradle`).\n- Confirm whether the standalone OpenEJB HTTP server is serving web services that use WS-Security UsernameToken authentication.","fix":"- OpenEJB `10.3.0`\n- OpenEJB `11.0.0-M2`","status":"open","published_at":"2026-11-10T16:17:15+00:00","first_seen_at":"2026-11-10T16:22:32+00:00","triaged_at":"2026-11-10T16:24:22+00:00","updated_at":"2026-11-10T16:24:22+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-10T16:24:22Z","model":"claude-haiku-5-5","output":{"fix":"- OpenEJB `10.3.0`\n- OpenEJB `11.0.0-M2`","reach":"internet","title":"OpenEJB: web service caller identity leaks to later requests on same thread","impact":"high","summary":"After a successful WS-Security UsernameToken login, OpenEJB's standalone HTTP server keeps the caller's identity attached to the worker thread after the request ends. A later unauthenticated request handled on that same thread can call protected EJB methods as the previously logged-in user.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["openejb","java","web-services","ws-security"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Remote callers invoke protected EJB methods as another authenticated user.","analyst_note":"","how_to_check":"- Check the OpenEJB version in your build files or the server's lib directory (for example `openejb-core` in `pom.xml` or `build.gradle`).\n- Confirm whether the standalone OpenEJB HTTP server is serving web services that use WS-Security UsernameToken authentication.","plain_action":"","product_name":"OpenEJB","needs_analyst":false,"not_affected_if":["no-web-services","other-container"],"who_is_affected":"Systems running the standalone OpenEJB HTTP server that expose web services secured with WS-Security UsernameToken authentication. Applications that use OpenEJB only inside a different container, or that do not serve web services over that HTTP server, are not described as affected by the sources.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.001162,"input_tokens":4589,"output_tokens":1406,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-111245':15A,18A '-2026':14A,17A '10.3.0':142C '11.0.0':144C 'associ':89C 'attach':47B 'attack':112C 'authent':84C,133C 'call':66B 'caller':4A,44B,86C 'complet':97C 'cve':13A,16A 'ejb':68B,125C 'end':55B 'fix':147C 'handl':60B 'http':40B,107C 'ident':5A,46B,87C,129C 'invok':123C 'issu':149C 'java':20B 'keep':42B 'later':8A,57B,116C 'leak':6A 'log':74B 'logged-in':73B 'login':36B 'm2':145C 'method':69B,126C 'openejb':1A,19A,21B,37B,106C 'previous':72B,132C 'process':117C 'protect':67B,124C 'recommend':137C 'remot':110C 'request':9A,54B,59B,96C,114C 'runtim':22B 'secur':28B,34B,82C 'serv':102C 'server':41B,108C 'servic':3A,25B,100C 'standalon':39B,105C 'stay':88C 'success':31B,79C 'thread':12A,51B,64B,93C,121C 'unauthent':58B,111C 'upgrad':139C 'user':76B,134C,135C 'usernametoken':35B,83C 'version':141C 'web':2A,24B,99C 'web-servic':23B 'whose':113C 'worker':50B,92C 'ws':27B,33B,81C 'ws-secur':26B,32B,80C","nicknames":[],"mitigations":[],"who_affected":"Systems running the standalone OpenEJB HTTP server that expose web services secured with WS-Security UsernameToken authentication. Applications that use OpenEJB only inside a different container, or that do not serve web services over that HTTP server, are not described as affected by the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["openejb"],"ptokens":["openejb"],"labels":["high","java","openejb","runtime","vendor","webservices","wssecurity"],"campaign_type":null,"search_a":"'-111245':15A,18A '-2026':14A,17A 'caller':4A 'cve':13A,16A 'ident':5A 'later':8A 'leak':6A 'openejb':1A,19A 'request':9A 'servic':3A 'thread':12A 'web':2A","search_b":"'attach':47B 'call':66B 'caller':44B 'ejb':68B 'end':55B 'handl':60B 'http':40B 'ident':46B 'java':20B 'keep':42B 'later':57B 'log':74B 'logged-in':73B 'login':36B 'method':69B 'openejb':21B,37B 'previous':72B 'protect':67B 'request':54B,59B 'runtim':22B 'secur':28B,34B 'server':41B 'servic':25B 'standalon':39B 'success':31B 'thread':51B,64B 'unauthent':58B 'user':76B 'usernametoken':35B 'web':24B 'web-servic':23B 'worker':50B 'ws':27B,33B 'ws-secur':26B,32B","search_c":"'10.3.0':142C '11.0.0':144C 'associ':89C 'attack':112C 'authent':84C,133C 'caller':86C 'complet':97C 'ejb':125C 'fix':147C 'http':107C 'ident':87C,129C 'invok':123C 'issu':149C 'later':116C 'm2':145C 'method':126C 'openejb':106C 'previous':132C 'process':117C 'protect':124C 'recommend':137C 'remot':110C 'request':96C,114C 'secur':82C 'serv':102C 'server':108C 'servic':100C 'standalon':105C 'stay':88C 'success':79C 'thread':93C,121C 'unauthent':111C 'upgrad':139C 'user':134C,135C 'usernametoken':83C 'version':141C 'web':99C 'whose':113C 'worker':92C 'ws':81C 'ws-secur':80C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T16:17:15+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111245","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111245","severity":null,"published_at":"2026-11-10T16:17:15+00:00","modified_at":"2026-11-10T16:17:15+00:00","first_seen_at":"2026-11-10T16:22:32+00:00","fetched_at":"2026-11-10T16:22:32+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}