{"id":"CVE-2026-111256","kind":"vulnerability","aliases":["CVE-2026-111256"],"related":[],"title":"Apache TomEE: embedded OpenEJB HTTP server drops authentication on JAX-WS and JAX-RS endpoints","description":"When JAX-WS or JAX-RS endpoints are published by the embedded OpenEJB HTTP server rather than Tomcat, some configured authentication methods are silently ignored and the endpoint is published without authentication. A remote unauthenticated attacker can invoke the exposed operations without credentials. Only deployments that use the embedded HTTP server and rely on such an authentication method are affected. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions.","summary":"When JAX-WS or JAX-RS web endpoints are published by the embedded OpenEJB HTTP server instead of Tomcat, some configured authentication methods are silently ignored. An remote attacker with no credentials can call the exposed operations.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["java","jax-rs","jax-ws","openejb","runtime","tomee"],"not_affected_if":["no-auth-dependency","no-jax-ws-or-jax-rs","tomcat-based-tomee"],"how_to_check":"- Check whether the application runs on the embedded OpenEJB HTTP server rather than Tomcat, for example by looking for the embedded server in the deployment setup.\n- Check whether the endpoints rely on an authentication method that the embedded server ignores.\n- Check the TomEE version in use against the product ranges, which the sources do not list.","fix":"- Move to the Tomcat based TomEE distributions, as the source recommends.\n- Until then, block network access to the embedded HTTP server from untrusted clients, as the source recommends.\n- Fixed version: unknown","status":"open","published_at":"2026-11-10T16:17:16+00:00","first_seen_at":"2026-11-10T16:22:33+00:00","triaged_at":"2026-11-10T16:24:08+00:00","updated_at":"2026-11-10T16:24:08+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-10T16:24:08Z","model":"claude-haiku-5-5","output":{"fix":"- Move to the Tomcat based TomEE distributions, as the source recommends.\n- Until then, block network access to the embedded HTTP server from untrusted clients, as the source recommends.\n- Fixed version: unknown","reach":"internet","title":"Apache TomEE: embedded OpenEJB HTTP server drops authentication on JAX-WS and JAX-RS endpoints","impact":"high","summary":"When JAX-WS or JAX-RS web endpoints are published by the embedded OpenEJB HTTP server instead of Tomcat, some configured authentication methods are silently ignored. An remote attacker with no credentials can call the exposed operations.","audience":"developers","category":"runtime","nicknames":[],"who_cares":["tomee","openejb","java","jax-ws","jax-rs"],"confidence":0.6,"fix_status":"none","needs_auth":"no","worst_case":"unauthenticated remote callers invoke protected web service operations","analyst_note":"Confirm affected TomEE and OpenEJB version ranges and any fixed version from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-111256.","how_to_check":"- Check whether the application runs on the embedded OpenEJB HTTP server rather than Tomcat, for example by looking for the embedded server in the deployment setup.\n- Check whether the endpoints rely on an authentication method that the embedded server ignores.\n- Check the TomEE version in use against the product ranges, which the sources do not list.","plain_action":"","product_name":"Apache TomEE","needs_analyst":true,"not_affected_if":["tomcat-based-tomee","no-jax-ws-or-jax-rs","no-auth-dependency"],"who_is_affected":"Only deployments that publish JAX-WS or JAX-RS endpoints through the embedded OpenEJB HTTP server and rely on an authentication method that the server ignores are exposed. Applications served by Tomcat-based TomEE are not described as affected.","user_interaction":"no","product_ecosystem":"runtime","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000833,"input_tokens":4633,"output_tokens":740,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-111256':20A,23A '-2026':19A,22A 'access':141C 'affect':134C 'apach':1A 'attack':64B,110C 'authent':8A,57B,95C,106C,131C 'base':156C 'block':139C 'call':69B 'client':149C 'configur':56B,94C 'credenti':67B,117C 'cve':18A,21A 'deploy':119C 'distribut':158C 'drop':7A 'embed':3A,48B,86C,123C,144C 'endpoint':17A,43B,81C,102C 'expos':71B,114C 'http':5A,50B,88C,124C,145C 'ignor':61B,99C 'instead':52B 'invok':112C 'java':24B 'jax':11A,15A,26B,29B,36B,40B,75C,79C 'jax-r':14A,25B,39B,78C 'jax-w':10A,28B,35B,74C 'method':58B,96C,132C 'migrat':152C 'network':140C 'openejb':4A,31B,49B,87C 'oper':72B,115C 'publish':45B,83C,104C 'rather':90C 'recommend':137C 'reli':127C 'remot':63B,108C 'rs':16A,27B,41B,80C 'runtim':32B 'server':6A,51B,89C,125C,146C 'silent':60B,98C 'tomcat':54B,92C,155C 'tome':2A,33B,157C 'unauthent':109C 'untrust':148C 'use':121C 'user':135C 'web':42B 'without':105C,116C 'ws':12A,30B,37B,76C","nicknames":[],"mitigations":[],"who_affected":"Only deployments that publish JAX-WS or JAX-RS endpoints through the embedded OpenEJB HTTP server and rely on an authentication method that the server ignores are exposed. Applications served by Tomcat-based TomEE are not described as affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","java","jaxrs","jaxws","openejb","runtime","tomee"],"campaign_type":null,"search_a":"'-111256':20A,23A '-2026':19A,22A 'apach':1A 'authent':8A 'cve':18A,21A 'drop':7A 'embed':3A 'endpoint':17A 'http':5A 'jax':11A,15A 'jax-r':14A 'jax-w':10A 'openejb':4A 'rs':16A 'server':6A 'tome':2A 'ws':12A","search_b":"'attack':64B 'authent':57B 'call':69B 'configur':56B 'credenti':67B 'embed':48B 'endpoint':43B 'expos':71B 'http':50B 'ignor':61B 'instead':52B 'java':24B 'jax':26B,29B,36B,40B 'jax-r':25B,39B 'jax-w':28B,35B 'method':58B 'openejb':31B,49B 'oper':72B 'publish':45B 'remot':63B 'rs':27B,41B 'runtim':32B 'server':51B 'silent':60B 'tomcat':54B 'tome':33B 'web':42B 'ws':30B,37B","search_c":"'access':141C 'affect':134C 'attack':110C 'authent':95C,106C,131C 'base':156C 'block':139C 'client':149C 'configur':94C 'credenti':117C 'deploy':119C 'distribut':158C 'embed':86C,123C,144C 'endpoint':81C,102C 'expos':114C 'http':88C,124C,145C 'ignor':99C 'invok':112C 'jax':75C,79C 'jax-r':78C 'jax-w':74C 'method':96C,132C 'migrat':152C 'network':140C 'openejb':87C 'oper':115C 'publish':83C,104C 'rather':90C 'recommend':137C 'reli':127C 'remot':108C 'rs':80C 'server':89C,125C,146C 'silent':98C 'tomcat':92C,155C 'tome':157C 'unauthent':109C 'untrust':148C 'use':121C 'user':135C 'without':105C,116C 'ws':76C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T16:17:16+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111256","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111256","severity":null,"published_at":"2026-11-10T16:17:16+00:00","modified_at":"2026-11-10T16:17:16+00:00","first_seen_at":"2026-11-10T16:22:33+00:00","fetched_at":"2026-11-10T16:22:33+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}