---
id: "CVE-2026-111246"
page: "https://infrastack.ai/live/CVE-2026-111246"
kind: "vulnerability"
aliases: ["CVE-2026-111246"]
title: "OpenEJB: embedded HTTP server shares sessions across web applications"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "openejb", "fixed": [], "affected": "", "ecosystem": "maven"}]
ecosystems: ["maven"]
tags: ["java", "openejb", "runtime", "self-hosted", "tomee"]
not_affected_if: ["single-web-application", "tomcat-based-tomee"]
published_at: "2026-11-10T16:17:15+00:00"
first_seen_at: "2026-11-10T16:22:33+00:00"
updated_at: "2026-11-10T16:24:15+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111246", "first_seen_at": "2026-11-10T16:22:33+00:00"}]
exploit_sources: []
---

# OpenEJB: embedded HTTP server shares sessions across web applications

Link for people: https://infrastack.ai/live/CVE-2026-111246 (this .md is for agents)

The embedded OpenEJB HTTP server does not keep HTTP sessions separate between web applications it hosts. A remote attacker can reuse a session from one web application inside another, which trusts session state the first application set.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- maven:openejb affected range not listed fixed no fixed version listed

## How to check

- Check whether the deployment runs the embedded OpenEJB HTTP server with more than one web application deployed on it.
- Check whether the server is reachable from untrusted networks.

## Timeline

- 2026-11-10T16:22:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111246

## From the sources

The embedded OpenEJB HTTP server does not isolate HTTP sessions between web applications. A remote attacker can use a session established in one web application in another one, which then trusts session state set by the first application. Only deployments hosting several web applications on the embedded HTTP server are affected. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_