CVE-2026-111257 · Runtime
NO FIX YET · SEE WHAT TO DO
With the default configuration and an empty default user database, TomEE silently creates an administrative user with a well-known password at startup. A remote attacker can log in with those credentials to web applications using the default realm and gain the TomEE administrative role.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Servers running Apache TomEE with the default configuration and no users defined in the default user database are exposed. Applications that rely on the default realm accept the built-in administrative credentials, so an attacker on the network can reach them. Deployments that define their own users or use a different realm are not described as affected.
Not affected if custom-realm, users-defined
Who cares java, self-hosted, tomee
unknown if the sources do not name a command10.3.0 or 11.0.0-M2, which the sources state fix the issueWith the default configuration and no users defined in the default user database, TomEE silently adds an administrative user with a well-known password at startup. A remote attacker can use these credentials to authenticate to web applications that use the default realm and grant access to any authenticated user or to the TomEE administrative role. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.