---
id: "CVE-2026-111256"
page: "https://infrastack.ai/live/CVE-2026-111256"
kind: "vulnerability"
aliases: ["CVE-2026-111256"]
title: "Apache TomEE: embedded OpenEJB HTTP server drops authentication on JAX-WS and JAX-RS endpoints"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["java", "jax-rs", "jax-ws", "openejb", "runtime", "tomee"]
not_affected_if: ["no-auth-dependency", "no-jax-ws-or-jax-rs", "tomcat-based-tomee"]
published_at: "2026-11-10T16:17:16+00:00"
first_seen_at: "2026-11-10T16:22:33+00:00"
updated_at: "2026-11-10T16:24:08+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111256", "first_seen_at": "2026-11-10T16:22:33+00:00"}]
exploit_sources: []
---

# Apache TomEE: embedded OpenEJB HTTP server drops authentication on JAX-WS and JAX-RS endpoints

Link for people: https://infrastack.ai/live/CVE-2026-111256 (this .md is for agents)

When JAX-WS or JAX-RS web endpoints are published by the embedded OpenEJB HTTP server instead of Tomcat, some configured authentication methods are silently ignored. An remote attacker with no credentials can call the exposed operations.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the application runs on the embedded OpenEJB HTTP server rather than Tomcat, for example by looking for the embedded server in the deployment setup.
- Check whether the endpoints rely on an authentication method that the embedded server ignores.
- Check the TomEE version in use against the product ranges, which the sources do not list.

## Fix

- Move to the Tomcat based TomEE distributions, as the source recommends.
- Until then, block network access to the embedded HTTP server from untrusted clients, as the source recommends.
- Fixed version: unknown

## Timeline

- 2026-11-10T16:22:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111256

## From the sources

When JAX-WS or JAX-RS endpoints are published by the embedded OpenEJB HTTP server rather than Tomcat, some configured authentication methods are silently ignored and the endpoint is published without authentication. A remote unauthenticated attacker can invoke the exposed operations without credentials. Only deployments that use the embedded HTTP server and rely on such an authentication method are affected. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_