{"id":"CVE-2026-97870","kind":"vulnerability","aliases":["CVE-2026-97870"],"related":[],"title":"Apache TomEE: Hessian remoting on embedded HTTP server ignores authentication and transport security settings","description":"When Hessian remoting endpoints are served by the embedded HTTP server, configured authentication and transport security requirements are silently ignored. A remote unauthenticated attacker can invoke the exposed EJB methods without credentials or over an unencrypted connection. Only deployments that use the embedded HTTP server rather than Tomcat and rely on these settings are affected. Users are recommended to block network access to Hessian endpoints from untrusted clients, or to migrate to another remoting protocol.","summary":"When Hessian remoting endpoints run on the embedded HTTP server, configured authentication and encryption requirements are silently not enforced. A remote attacker without credentials can call the exposed EJB methods, including over unencrypted connections.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"openejb-hessian","fixed":[],"affected":"4.6.0 - 4.7.5; 7.0.0-M1 - 10.2.0; 11.0.0-M1","ecosystem":"maven"}],"ecosystems":[],"tags":["apache-tomee","ejb","embedded-http-server","hessian","java","openejb","runtime"],"not_affected_if":["auth-not-relied-on","no-hessian-endpoints","tomcat-deployment"],"how_to_check":"- Check your TomEE version: affected are openejb-hessian 4.6.0-4.7.5, 7.0.0-M1 up to 10.2.0, and 11.0.0-M1.\n- Check whether openejb-hessian is on the classpath (lib/ or the webapp) and whether Hessian EJB endpoints are served by the embedded OpenEJB HTTP server (openejb-http) rather than Tomcat.\n- Check whether those endpoints are reachable from untrusted networks.","fix":"No fixed version of openejb-hessian exists. Upgrade to Apache TomEE 10.3.0 or 11.0.0-M2, which remove the module (read migration guides first; several fixes change defaults). If you cannot upgrade, block network access to Hessian endpoints from untrusted clients or stop using Hessian remoting.","status":"open","published_at":"2026-11-10T16:17:26+00:00","first_seen_at":"2026-11-10T16:22:35+00:00","triaged_at":"2026-11-10T16:23:54+00:00","updated_at":"2026-11-10T16:32:32+00:00","category":"runtime","confidence":0.85,"triage":{"at":"2026-11-10T16:23:54Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Hessian remoting on embedded HTTP server skips authentication and transport security","impact":"high","summary":"When Hessian remoting endpoints run on the embedded HTTP server, configured authentication and encryption requirements are silently not enforced. A remote attacker without credentials can call the exposed EJB methods, including over unencrypted connections.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["hessian","ejb","embedded-http-server","java"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Unauthenticated remote attacker invokes EJB methods without credentials or encryption","analyst_note":"Identify the affected product and versions and any vendor fix from the NVD entry or upstream advisory; the sources give no products or fixed versions.","how_to_check":"- Check whether the application serves Hessian remoting endpoints through the embedded HTTP server rather than Tomcat.\n- Review the configured authentication and transport security settings for those endpoints and confirm they are not being applied.\n- Check whether Hessian endpoints are reachable from untrusted networks.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["tomcat-deployment","no-hessian-endpoints","auth-not-relied-on"],"who_is_affected":"Only deployments that serve Hessian remoting endpoints through the embedded HTTP server instead of Tomcat and rely on authentication or transport security settings for them. Deployments using Tomcat, or without Hessian endpoints, are not described as affected. The sources recommend blocking network access to Hessian endpoints from untrusted clients or migrating to another remoting protocol.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000783,"input_tokens":4602,"output_tokens":645,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Identify the affected product and versions and any vendor fix from the NVD entry or upstream advisory; the sources give no products or fixed versions.","search":"'-2026':16A,19A '-97870':17A,20A 'access':131C 'affect':124C 'anoth':142C 'apach':1A,25B 'apache-tome':24B 'attack':57B,93C 'authent':10A,47B,82C 'block':129C 'call':61B 'client':137C 'configur':46B,81C 'connect':69B,106C 'credenti':59B,101C 'cve':15A,18A 'deploy':108C 'ejb':27B,64B,98C 'embed':6A,29B,43B,78C,112C 'embedded-http-serv':28B 'encrypt':49B 'endpoint':39B,73C,134C 'enforc':54B 'expos':63B,97C 'hessian':3A,23A,32B,37B,71C,133C 'http':7A,30B,44B,79C,113C 'ignor':9A,89C 'includ':66B 'invok':95C 'java':33B 'method':65B,99C 'migrat':140C 'network':130C 'openejb':22A,34B 'openejb-hessian':21A 'protocol':144C 'rather':115C 'recommend':127C 'reli':119C 'remot':4A,38B,56B,72C,91C,143C 'requir':50B,86C 'run':40B 'runtim':35B 'secur':13A,85C 'serv':75C 'server':8A,31B,45B,80C,114C 'set':14A,122C 'silent':52B,88C 'tomcat':117C 'tome':2A,26B 'transport':12A,84C 'unauthent':92C 'unencrypt':68B,105C 'untrust':136C 'use':110C 'user':125C 'without':58B,100C","nicknames":[],"mitigations":[],"who_affected":"Applications on Apache TomEE (or OpenEJB) that expose EJBs over Hessian remoting through the embedded OpenEJB HTTP server and rely on configured authentication or transport security for them. Those settings are silently ignored, so an unauthenticated remote caller can invoke the EJB methods, including over unencrypted connections. Deployments on Tomcat, or without Hessian endpoints, can skip it.","tier":"C","verified":{"fix":{"at":"2026-11-10T16:25:24Z","by":"analyst","doc":"https://tomee.apache.org/security/tomee.html","run_id":2466},"products":{"at":"2026-11-10T16:25:24Z","by":"analyst","doc":"https://tomee.apache.org/security/tomee.html","run_id":2466},"workarounds":{"at":"2026-11-10T16:25:24Z","by":"analyst","doc":"https://tomee.apache.org/security/tomee.html","run_id":2466},"how_to_check":{"at":"2026-11-10T16:25:24Z","by":"analyst","doc":"https://tomee.apache.org/security/tomee.html","run_id":2466},"who_affected":{"at":"2026-11-10T16:25:24Z","by":"analyst","doc":"https://tomee.apache.org/security/tomee.html","run_id":2466}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["openejbhessian"],"ptokens":["hessian","openejb"],"labels":["apachetomee","ejb","embeddedhttpserver","hessian","java","medium","openejb","runtime"],"campaign_type":null,"search_a":"'-2026':16A,19A '-97870':17A,20A 'apach':1A 'authent':10A 'cve':15A,18A 'embed':6A 'hessian':3A,23A 'http':7A 'ignor':9A 'openejb':22A 'openejb-hessian':21A 'remot':4A 'secur':13A 'server':8A 'set':14A 'tome':2A 'transport':12A","search_b":"'apach':25B 'apache-tome':24B 'attack':57B 'authent':47B 'call':61B 'configur':46B 'connect':69B 'credenti':59B 'ejb':27B,64B 'embed':29B,43B 'embedded-http-serv':28B 'encrypt':49B 'endpoint':39B 'enforc':54B 'expos':63B 'hessian':32B,37B 'http':30B,44B 'includ':66B 'java':33B 'method':65B 'openejb':34B 'remot':38B,56B 'requir':50B 'run':40B 'runtim':35B 'server':31B,45B 'silent':52B 'tome':26B 'unencrypt':68B 'without':58B","search_c":"'access':131C 'affect':124C 'anoth':142C 'attack':93C 'authent':82C 'block':129C 'client':137C 'configur':81C 'connect':106C 'credenti':101C 'deploy':108C 'ejb':98C 'embed':78C,112C 'endpoint':73C,134C 'expos':97C 'hessian':71C,133C 'http':79C,113C 'ignor':89C 'invok':95C 'method':99C 'migrat':140C 'network':130C 'protocol':144C 'rather':115C 'recommend':127C 'reli':119C 'remot':72C,91C,143C 'requir':86C 'secur':85C 'serv':75C 'server':80C,114C 'set':122C 'silent':88C 'tomcat':117C 'transport':84C 'unauthent':92C 'unencrypt':105C 'untrust':136C 'use':110C 'user':125C 'without':100C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T16:17:26+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-97870","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97870","severity":null,"published_at":"2026-11-10T16:17:26+00:00","modified_at":"2026-11-10T16:17:26+00:00","first_seen_at":"2026-11-10T16:22:35+00:00","fetched_at":"2026-11-10T16:22:35+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-97870:2466","url":"https://tomee.apache.org/security/tomee.html","severity":null,"published_at":"2026-11-10T16:25:24+00:00","modified_at":"2026-11-10T16:25:24+00:00","first_seen_at":"2026-11-10T16:25:24+00:00","fetched_at":"2026-11-10T16:25:24+00:00","note":"Apache TomEE advisory page (read via WebFetch; lists.apache.org thread unreadable). Vendor rates Moderate (severity set medium on that basis); module removed in 10.3.0/11.0.0-M2, no fixed module version.","cites":["https://tomee.apache.org/security/tomee.html"]}],"documents":[{"id":116250,"url":"https://tomee.apache.org/security/tomee.html","title":"Apache TomEE Security Vulnerabilities (fixed in 10.3.0 / 11.0.0-M2)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}