---
id: "CVE-2026-97870"
page: "https://infrastack.ai/live/CVE-2026-97870"
kind: "vulnerability"
aliases: ["CVE-2026-97870"]
title: "Apache TomEE: Hessian remoting on embedded HTTP server ignores authentication and transport security settings"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "openejb-hessian", "fixed": [], "affected": "4.6.0 - 4.7.5; 7.0.0-M1 - 10.2.0; 11.0.0-M1", "ecosystem": "maven"}]
ecosystems: []
tags: ["apache-tomee", "ejb", "embedded-http-server", "hessian", "java", "openejb", "runtime"]
not_affected_if: ["auth-not-relied-on", "no-hessian-endpoints", "tomcat-deployment"]
published_at: "2026-11-10T16:17:26+00:00"
first_seen_at: "2026-11-10T16:22:35+00:00"
updated_at: "2026-11-10T16:32:32+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97870", "first_seen_at": "2026-11-10T16:22:35+00:00"}, {"source": "analyst", "url": "https://tomee.apache.org/security/tomee.html", "first_seen_at": "2026-11-10T16:25:24+00:00", "cites": ["https://tomee.apache.org/security/tomee.html"]}]
exploit_sources: []
---

# Apache TomEE: Hessian remoting on embedded HTTP server ignores authentication and transport security settings

Link for people: https://infrastack.ai/live/CVE-2026-97870 (this .md is for agents)

When Hessian remoting endpoints run on the embedded HTTP server, configured authentication and encryption requirements are silently not enforced. A remote attacker without credentials can call the exposed EJB methods, including over unencrypted connections.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- maven:openejb-hessian affected 4.6.0 - 4.7.5; 7.0.0-M1 - 10.2.0; 11.0.0-M1 fixed no fixed version listed

## How to check

- Check your TomEE version: affected are openejb-hessian 4.6.0-4.7.5, 7.0.0-M1 up to 10.2.0, and 11.0.0-M1.
- Check whether openejb-hessian is on the classpath (lib/ or the webapp) and whether Hessian EJB endpoints are served by the embedded OpenEJB HTTP server (openejb-http) rather than Tomcat.
- Check whether those endpoints are reachable from untrusted networks.

## Fix

No fixed version of openejb-hessian exists. Upgrade to Apache TomEE 10.3.0 or 11.0.0-M2, which remove the module (read migration guides first; several fixes change defaults). If you cannot upgrade, block network access to Hessian endpoints from untrusted clients or stop using Hessian remoting.

## Timeline

- 2026-11-10T16:22:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-97870
- 2026-11-10T16:25:24+00:00 analyst https://tomee.apache.org/security/tomee.html — Apache TomEE advisory page (read via WebFetch; lists.apache.org thread unreadable). Vendor rates Moderate (severity set medium on that basis); module removed in 10.3.0/11.0.0-M2, no fixed module version.

## Documents

- [advisory] Apache TomEE Security Vulnerabilities (fixed in 10.3.0 / 11.0.0-M2) https://tomee.apache.org/security/tomee.html

## From the sources

When Hessian remoting endpoints are served by the embedded HTTP server, configured authentication and transport security requirements are silently ignored. A remote unauthenticated attacker can invoke the exposed EJB methods without credentials or over an unencrypted connection. Only deployments that use the embedded HTTP server rather than Tomcat and rely on these settings are affected. Users are recommended to block network access to Hessian endpoints from untrusted clients, or to migrate to another remoting protocol.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_