{"id":"CVE-2026-111246","kind":"vulnerability","aliases":["CVE-2026-111246"],"related":[],"title":"OpenEJB: embedded HTTP server shares sessions across web applications","description":"The embedded OpenEJB HTTP server does not isolate HTTP sessions between web applications. A remote attacker can use a session established in one web application in another one, which then trusts session state set by the first application. Only deployments hosting several web applications on the embedded HTTP server are affected. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions.","summary":"The embedded OpenEJB HTTP server does not keep HTTP sessions separate between web applications it hosts. A remote attacker can reuse a session from one web application inside another, which trusts session state the first application set.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"openejb","fixed":[],"affected":"","ecosystem":"maven"}],"ecosystems":["maven"],"tags":["java","openejb","runtime","self-hosted","tomee"],"not_affected_if":["single-web-application","tomcat-based-tomee"],"how_to_check":"- Check whether the deployment runs the embedded OpenEJB HTTP server with more than one web application deployed on it.\n- Check whether the server is reachable from untrusted networks.","fix":null,"status":"open","published_at":"2026-11-10T16:17:15+00:00","first_seen_at":"2026-11-10T16:22:33+00:00","triaged_at":"2026-11-10T16:24:15+00:00","updated_at":"2026-11-10T16:24:15+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-11-10T16:24:15Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"OpenEJB: embedded HTTP server shares sessions across web applications","impact":"medium","summary":"The embedded OpenEJB HTTP server does not keep HTTP sessions separate between web applications it hosts. A remote attacker can reuse a session from one web application inside another, which trusts session state the first application set.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["openejb","tomee","java","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"remote session reuse across web applications, trusting attacker-chosen session state","analyst_note":"Confirm affected and fixed OpenEJB versions and whether the advisory names a fix, at https://nvd.nist.gov/vuln/detail/CVE-2026-111246.","how_to_check":"- Check whether the deployment runs the embedded OpenEJB HTTP server with more than one web application deployed on it.\n- Check whether the server is reachable from untrusted networks.\n- unknown for version ranges: the sources do not list affected or fixed versions.","plain_action":"","product_name":"openejb","needs_analyst":true,"not_affected_if":["single-web-application","tomcat-based-tomee"],"who_is_affected":"Only deployments that host several web applications on the embedded OpenEJB HTTP server are affected, according to the description. Single-application deployments are not described as affected. The sources recommend blocking network access to the embedded HTTP server from untrusted clients, or migrating to the Tomcat-based TomEE distributions.","user_interaction":"no","product_ecosystem":"maven","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.00076,"input_tokens":4578,"output_tokens":604,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-111246':12A,15A '-2026':11A,14A 'access':118C 'across':7A 'affect':111C 'anoth':52B,87C 'applic':9A,37B,50B,59B,73C,85C,98C,104C 'attack':42B,76C 'base':133C 'block':116C 'client':126C 'cve':10A,13A 'deploy':100C 'distribut':135C 'embed':2A,25B,62C,107C,121C 'establish':81C 'first':58B,97C 'host':22B,39B,101C 'http':3A,27B,32B,64C,69C,108C,122C 'insid':51B 'isol':68C 'java':17B 'keep':31B 'migrat':129C 'network':117C 'one':48B,83C,88C 'openejb':1A,16A,18B,26B,63C 'recommend':114C 'remot':41B,75C 'reus':44B 'runtim':19B 'self':21B 'self-host':20B 'separ':34B 'server':4A,28B,65C,109C,123C 'session':6A,33B,46B,55B,70C,80C,92C 'set':60B,94C 'sever':102C 'share':5A 'state':56B,93C 'tomcat':132C 'tome':23B,134C 'trust':54B,91C 'untrust':125C 'use':78C 'user':112C 'web':8A,36B,49B,72C,84C,103C","nicknames":[],"mitigations":[],"who_affected":"Only deployments that host several web applications on the embedded OpenEJB HTTP server are affected, according to the description. Single-application deployments are not described as affected. The sources recommend blocking network access to the embedded HTTP server from untrusted clients, or migrating to the Tomcat-based TomEE distributions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["openejb"],"ptokens":["openejb"],"labels":["java","maven","openejb","runtime","selfhosted","tomee","unknown"],"campaign_type":null,"search_a":"'-111246':12A,15A '-2026':11A,14A 'across':7A 'applic':9A 'cve':10A,13A 'embed':2A 'http':3A 'openejb':1A,16A 'server':4A 'session':6A 'share':5A 'web':8A","search_b":"'anoth':52B 'applic':37B,50B,59B 'attack':42B 'embed':25B 'first':58B 'host':22B,39B 'http':27B,32B 'insid':51B 'java':17B 'keep':31B 'one':48B 'openejb':18B,26B 'remot':41B 'reus':44B 'runtim':19B 'self':21B 'self-host':20B 'separ':34B 'server':28B 'session':33B,46B,55B 'set':60B 'state':56B 'tome':23B 'trust':54B 'web':36B,49B","search_c":"'access':118C 'affect':111C 'anoth':87C 'applic':73C,85C,98C,104C 'attack':76C 'base':133C 'block':116C 'client':126C 'deploy':100C 'distribut':135C 'embed':62C,107C,121C 'establish':81C 'first':97C 'host':101C 'http':64C,69C,108C,122C 'isol':68C 'migrat':129C 'network':117C 'one':83C,88C 'openejb':63C 'recommend':114C 'remot':75C 'server':65C,109C,123C 'session':70C,80C,92C 'set':94C 'sever':102C 'state':93C 'tomcat':132C 'tome':134C 'trust':91C 'untrust':125C 'use':78C 'user':112C 'web':72C,84C,103C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T16:17:15+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111246","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111246","severity":null,"published_at":"2026-11-10T16:17:15+00:00","modified_at":"2026-11-10T16:17:15+00:00","first_seen_at":"2026-11-10T16:22:33+00:00","fetched_at":"2026-11-10T16:22:33+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}