---
id: "CVE-2026-111257"
page: "https://infrastack.ai/live/CVE-2026-111257"
kind: "vulnerability"
aliases: ["CVE-2026-111257"]
title: "Apache TomEE: default setup adds an admin user with a known password"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["java", "runtime", "self-hosted", "tomee"]
not_affected_if: ["custom-realm", "users-defined"]
published_at: "2026-11-10T16:17:16+00:00"
first_seen_at: "2026-11-10T16:22:33+00:00"
updated_at: "2026-11-10T16:24:07+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111257", "first_seen_at": "2026-11-10T16:22:33+00:00"}]
exploit_sources: []
---

# Apache TomEE: default setup adds an admin user with a known password

Link for people: https://infrastack.ai/live/CVE-2026-111257 (this .md is for agents)

With the default configuration and an empty default user database, TomEE silently creates an administrative user with a well-known password at startup. A remote attacker can log in with those credentials to web applications using the default realm and gain the TomEE administrative role.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Look for an administrative user in the TomEE default user database (tomcat-users.xml) that you did not create, using a well-known password
- Check the TomEE version with `unknown` if the sources do not name a command
- Confirm whether web applications use the default realm (unknown if the sources do not say)

## Fix

- Upgrade TomEE to `10.3.0` or `11.0.0-M2`, which the sources state fix the issue

## Timeline

- 2026-11-10T16:22:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111257

## From the sources

With the default configuration and no users defined in the default user database, TomEE silently adds an administrative user with a well-known password at startup. A remote attacker can use these credentials to authenticate to web applications that use the default realm and grant access to any authenticated user or to the TomEE administrative role. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_