APACHE TOMEE · CVE-2026-86336 · Runtime
NO FIX YET · SEE WHAT TO DO
Apache TomEE running on JDK 21 or later does not enforce configured access restrictions on EJB methods. A caller can invoke EJB methods that should be off limits to them.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications deployed on Apache TomEE running on JDK 21 or later that rely on EJB method-level access restrictions are exposed. Deployments on older JDKs, or apps that do not use EJB security restrictions, are less likely to be affected. The sources do not say which callers can reach the EJB methods over the network.
Not affected if jdk-below-21, no-ejb-authorization
Who cares apache-tomee, ejb, java, jdk21
java -version).@RolesAllowed, @DenyAll or ejb-jar.xml security constraints) to see which methods depend on them.10.3.0 or 11.0.0-M2, per the description.Apache TomEE running on JDK 21 or later skips EJB method authorization checks, allowing callers to invoke EJB methods without the configured access restrictions being enforced. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.