{"id":"CVE-2026-111251","kind":"vulnerability","aliases":["CVE-2026-111251"],"related":[],"title":"OpenEJB: admin port accepts unauthenticated stop requests, allowing server shutdown","description":"The admin service of the standalone OpenEJB server accepts stop requests without any authentication. Any local user or process able to connect to the admin port can stop the server, leading to denial of service; the admin service is enabled by default in the standalone server and bound to the loopback interface. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.","summary":"The standalone OpenEJB server's admin service accepts stop commands without any authentication. Any local user or process that can reach the admin port can shut the server down, causing a denial of service.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["java","openejb","runtime","self-hosted"],"not_affected_if":["admin-service-disabled","embedded-openejb","loopback-only-with-trusted-local-users"],"how_to_check":"- Check the OpenEJB version in use, for example from the server's lib directory or build file, against the fixed versions below.\n- Confirm whether the standalone server's admin service is enabled (it is on by default) and which interface and port it listens on (loopback by default).","fix":"- OpenEJB 10.x: upgrade to `10.3.0`\n- OpenEJB 11.x: upgrade to `11.0.0-M2`","status":"open","published_at":"2026-11-10T16:17:16+00:00","first_seen_at":"2026-11-10T16:22:33+00:00","triaged_at":"2026-11-10T16:24:11+00:00","updated_at":"2026-11-10T16:24:11+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-10T16:24:11Z","model":"claude-haiku-5-5","output":{"fix":"- OpenEJB 10.x: upgrade to `10.3.0`\n- OpenEJB 11.x: upgrade to `11.0.0-M2`","reach":"local","title":"OpenEJB: admin port accepts unauthenticated stop requests, allowing server shutdown","impact":"low","summary":"The standalone OpenEJB server's admin service accepts stop commands without any authentication. Any local user or process that can reach the admin port can shut the server down, causing a denial of service.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["openejb","java","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Any local process can stop the server, causing denial of service","analyst_note":"","how_to_check":"- Check the OpenEJB version in use, for example from the server's lib directory or build file, against the fixed versions below.\n- Confirm whether the standalone server's admin service is enabled (it is on by default) and which interface and port it listens on (loopback by default).","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["admin-service-disabled","loopback-only-with-trusted-local-users","embedded-openejb"],"who_is_affected":"Teams running the standalone OpenEJB server with its admin service enabled. The admin service is bound to loopback by default, so exposure is mainly from local users or processes on the same host, or from a non-default bind address that makes the port reachable from the network. Deployments embedding OpenEJB inside another application server, or with the admin service disabled, are not described as affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000746,"input_tokens":4559,"output_tokens":580,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-111251':13A,16A '-2026':12A,15A '10.3.0':116C '11.0.0':118C 'abl':76C 'accept':4A,30B,65C 'admin':2A,28B,45B,58C,81C,93C 'allow':8A 'authent':35B,70C 'bound':104C 'caus':52B 'command':32B 'connect':78C 'cve':11A,14A 'default':98C 'denial':54B,89C 'enabl':96C 'fix':121C 'host':22B 'interfac':108C 'issu':123C 'java':17B 'lead':87C 'local':37B,72C 'loopback':107C 'm2':119C 'openejb':1A,18B,25B,63C 'port':3A,46B,82C 'process':40B,75C 'reach':43B 'recommend':111C 'request':7A,67C 'runtim':19B 'self':21B 'self-host':20B 'server':9A,26B,50B,64C,86C,102C 'servic':29B,56B,59C,91C,94C 'shut':48B 'shutdown':10A 'standalon':24B,62C,101C 'stop':6A,31B,66C,84C 'unauthent':5A 'upgrad':113C 'user':38B,73C,109C 'version':115C 'without':33B,68C","nicknames":[],"mitigations":[],"who_affected":"Teams running the standalone OpenEJB server with its admin service enabled. The admin service is bound to loopback by default, so exposure is mainly from local users or processes on the same host, or from a non-default bind address that makes the port reachable from the network. Deployments embedding OpenEJB inside another application server, or with the admin service disabled, are not described as affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["java","medium","openejb","runtime","selfhosted"],"campaign_type":null,"search_a":"'-111251':13A,16A '-2026':12A,15A 'accept':4A 'admin':2A 'allow':8A 'cve':11A,14A 'openejb':1A 'port':3A 'request':7A 'server':9A 'shutdown':10A 'stop':6A 'unauthent':5A","search_b":"'accept':30B 'admin':28B,45B 'authent':35B 'caus':52B 'command':32B 'denial':54B 'host':22B 'java':17B 'local':37B 'openejb':18B,25B 'port':46B 'process':40B 'reach':43B 'runtim':19B 'self':21B 'self-host':20B 'server':26B,50B 'servic':29B,56B 'shut':48B 'standalon':24B 'stop':31B 'user':38B 'without':33B","search_c":"'10.3.0':116C '11.0.0':118C 'abl':76C 'accept':65C 'admin':58C,81C,93C 'authent':70C 'bound':104C 'connect':78C 'default':98C 'denial':89C 'enabl':96C 'fix':121C 'interfac':108C 'issu':123C 'lead':87C 'local':72C 'loopback':107C 'm2':119C 'openejb':63C 'port':82C 'process':75C 'recommend':111C 'request':67C 'server':64C,86C,102C 'servic':59C,91C,94C 'standalon':62C,101C 'stop':66C,84C 'upgrad':113C 'user':73C,109C 'version':115C 'without':68C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T16:17:16+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111251","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111251","severity":null,"published_at":"2026-11-10T16:17:16+00:00","modified_at":"2026-11-10T16:17:16+00:00","first_seen_at":"2026-11-10T16:22:33+00:00","fetched_at":"2026-11-10T16:22:33+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}