---
id: "CVE-2026-111251"
page: "https://infrastack.ai/live/CVE-2026-111251"
kind: "vulnerability"
aliases: ["CVE-2026-111251"]
title: "OpenEJB: admin port accepts unauthenticated stop requests, allowing server shutdown"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["java", "openejb", "runtime", "self-hosted"]
not_affected_if: ["admin-service-disabled", "embedded-openejb", "loopback-only-with-trusted-local-users"]
published_at: "2026-11-10T16:17:16+00:00"
first_seen_at: "2026-11-10T16:22:33+00:00"
updated_at: "2026-11-10T16:24:11+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111251", "first_seen_at": "2026-11-10T16:22:33+00:00"}]
exploit_sources: []
---

# OpenEJB: admin port accepts unauthenticated stop requests, allowing server shutdown

Link for people: https://infrastack.ai/live/CVE-2026-111251 (this .md is for agents)

The standalone OpenEJB server's admin service accepts stop commands without any authentication. Any local user or process that can reach the admin port can shut the server down, causing a denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the OpenEJB version in use, for example from the server's lib directory or build file, against the fixed versions below.
- Confirm whether the standalone server's admin service is enabled (it is on by default) and which interface and port it listens on (loopback by default).

## Fix

- OpenEJB 10.x: upgrade to `10.3.0`
- OpenEJB 11.x: upgrade to `11.0.0-M2`

## Timeline

- 2026-11-10T16:22:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111251

## From the sources

The admin service of the standalone OpenEJB server accepts stop requests without any authentication. Any local user or process able to connect to the admin port can stop the server, leading to denial of service; the admin service is enabled by default in the standalone server and bound to the loopback interface. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_