EJBD · CVE-2026-97867 · Other
NO FIX YET · SEE WHAT TO DO
The EJBd remote protocol returns datasource connection details, including database credentials, to any remote client that looks up a datasource. An attacker who can reach the EJBd endpoint can take those credentials and connect to the database directly.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Systems that run the EJBd remote protocol and expose its endpoint to clients that can reach it. The sources do not name the product or list affected version ranges, so exact exposure is unknown; a team that does not run EJBd can skip it.
Not affected if ejbd-not-deployed, endpoint-not-reachable
Who cares databases, ejbd, java
10.3.0 or 11.0.0-M2, which the sources state fix the issueThe EJBd remote protocol returns datasource connection details, including database credentials, to remote clients that look up a datasource. A remote client able to reach the EJBd endpoint can obtain the database credentials and connect to the database directly. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.