{"id":"CVE-2026-111257","kind":"vulnerability","aliases":["CVE-2026-111257"],"related":[],"title":"Apache TomEE: default setup adds an admin user with a known password","description":"With the default configuration and no users defined in the default user database, TomEE silently adds an administrative user with a well-known password at startup. A remote attacker can use these credentials to authenticate to web applications that use the default realm and grant access to any authenticated user or to the TomEE administrative role. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.","summary":"With the default configuration and an empty default user database, TomEE silently creates an administrative user with a well-known password at startup. A remote attacker can log in with those credentials to web applications using the default realm and gain the TomEE administrative role.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["java","runtime","self-hosted","tomee"],"not_affected_if":["custom-realm","users-defined"],"how_to_check":"- Look for an administrative user in the TomEE default user database (tomcat-users.xml) that you did not create, using a well-known password\n- Check the TomEE version with `unknown` if the sources do not name a command\n- Confirm whether web applications use the default realm (unknown if the sources do not say)","fix":"- Upgrade TomEE to `10.3.0` or `11.0.0-M2`, which the sources state fix the issue","status":"open","published_at":"2026-11-10T16:17:16+00:00","first_seen_at":"2026-11-10T16:22:33+00:00","triaged_at":"2026-11-10T16:24:07+00:00","updated_at":"2026-11-10T16:24:07+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-10T16:24:07Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade TomEE to `10.3.0` or `11.0.0-M2`, which the sources state fix the issue","reach":"network","title":"Apache TomEE: default setup adds an admin user with a known password","impact":"high","summary":"With the default configuration and an empty default user database, TomEE silently creates an administrative user with a well-known password at startup. A remote attacker can log in with those credentials to web applications using the default realm and gain the TomEE administrative role.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["tomee","java","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Attacker logs in as TomEE administrator with a well-known password","analyst_note":"Confirm the affected version range and the exact default-realm behaviour from the NVD entry or Apache TomEE security advisory.","how_to_check":"- Look for an administrative user in the TomEE default user database (tomcat-users.xml) that you did not create, using a well-known password\n- Check the TomEE version with `unknown` if the sources do not name a command\n- Confirm whether web applications use the default realm (unknown if the sources do not say)","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["custom-realm","users-defined"],"who_is_affected":"Servers running Apache TomEE with the default configuration and no users defined in the default user database are exposed. Applications that rely on the default realm accept the built-in administrative credentials, so an attacker on the network can reach them. Deployments that define their own users or use a different realm are not described as affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000756,"input_tokens":4563,"output_tokens":600,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-111257':15A,18A '-2026':14A,17A '10.3.0':135C '11.0.0':137C 'access':117C 'add':5A,86C 'admin':7A 'administr':39B,69B,88C,126C 'apach':1A 'applic':60B,109C 'attack':51B,100C 'authent':106C,120C 'configur':28B,74C 'creat':37B 'credenti':57B,104C 'cve':13A,16A 'databas':34B,83C 'default':3A,27B,32B,63B,73C,81C,113C 'defin':78C 'empti':31B 'fix':140C 'gain':66B 'grant':116C 'host':23B 'issu':142C 'java':19B 'known':11A,45B,94C 'log':53B 'm2':138C 'password':12A,46B,95C 'realm':64B,114C 'recommend':130C 'remot':50B,99C 'role':70B,127C 'runtim':20B 'self':22B 'self-host':21B 'setup':4A 'silent':36B,85C 'startup':48B,97C 'tome':2A,24B,35B,68B,84C,125C 'upgrad':132C 'use':61B,102C,111C 'user':8A,33B,40B,77C,82C,89C,121C,128C 'version':134C 'web':59B,108C 'well':44B,93C 'well-known':43B,92C","nicknames":[],"mitigations":[],"who_affected":"Servers running Apache TomEE with the default configuration and no users defined in the default user database are exposed. Applications that rely on the default realm accept the built-in administrative credentials, so an attacker on the network can reach them. Deployments that define their own users or use a different realm are not described as affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","java","runtime","selfhosted","tomee"],"campaign_type":null,"search_a":"'-111257':15A,18A '-2026':14A,17A 'add':5A 'admin':7A 'apach':1A 'cve':13A,16A 'default':3A 'known':11A 'password':12A 'setup':4A 'tome':2A 'user':8A","search_b":"'administr':39B,69B 'applic':60B 'attack':51B 'configur':28B 'creat':37B 'credenti':57B 'databas':34B 'default':27B,32B,63B 'empti':31B 'gain':66B 'host':23B 'java':19B 'known':45B 'log':53B 'password':46B 'realm':64B 'remot':50B 'role':70B 'runtim':20B 'self':22B 'self-host':21B 'silent':36B 'startup':48B 'tome':24B,35B,68B 'use':61B 'user':33B,40B 'web':59B 'well':44B 'well-known':43B","search_c":"'10.3.0':135C '11.0.0':137C 'access':117C 'add':86C 'administr':88C,126C 'applic':109C 'attack':100C 'authent':106C,120C 'configur':74C 'credenti':104C 'databas':83C 'default':73C,81C,113C 'defin':78C 'fix':140C 'grant':116C 'issu':142C 'known':94C 'm2':138C 'password':95C 'realm':114C 'recommend':130C 'remot':99C 'role':127C 'silent':85C 'startup':97C 'tome':84C,125C 'upgrad':132C 'use':102C,111C 'user':77C,82C,89C,121C,128C 'version':134C 'web':108C 'well':93C 'well-known':92C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T16:17:16+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111257","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111257","severity":null,"published_at":"2026-11-10T16:17:16+00:00","modified_at":"2026-11-10T16:17:16+00:00","first_seen_at":"2026-11-10T16:22:33+00:00","fetched_at":"2026-11-10T16:22:33+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}