CVE-2026-111263 · Runtime
NO FIX YET · SEE WHAT TO DO
TomEE does not enforce authentication configured for an EJB JAX-WS endpoint when that endpoint is published inside an existing web application. A remote unauthenticated attacker can call the web service operations unless the application adds its own web.xml security constraints or EJB method permissions.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications running on TomEE that expose an EJB JAX-WS web service inside an existing web application and rely only on the TomEE deployment descriptor for authentication. Standalone EJB deployments or endpoints already protected by web.xml security constraints or EJB method permissions are not exposed by this flaw, according to the description.
Not affected if auth-in-web-xml, ejb-method-permissions, no-jax-ws-endpoint
Who cares ejb, java, jax-ws, tomee, web-services
openejb-jar.xml or ejb-jar.xml) that require authentication, deployed inside a web applicationcatalina.sh version or the TomEE startup logweb.xml has security constraints covering the endpoint path, or whether EJB method permissions are set10.3.0 or 11.0.0-M2Authentication configured for an EJB JAX-WS endpoint in the TomEE deployment descriptor is not enforced when the endpoint is published within an existing web application. A remote unauthenticated attacker can invoke the web service operations, unless the application protects the endpoint with its own web.xml security constraints or EJB method permissions. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.