{"id":"CVE-2026-97881","kind":"vulnerability","aliases":["CVE-2026-97881"],"related":[],"title":"OpenEJB embedded HTTP server lets remote users read arbitrary server files","description":"The embedded OpenEJB HTTP server does not restrict static resource paths to the configured resource directories. A remote unauthenticated attacker can read arbitrary files accessible to the server process. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions.","summary":"The embedded HTTP server in OpenEJB does not limit static resource requests to its configured directories. A remote unauthenticated attacker can read any file the server process can access.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["java","openejb","package","self-hosted"],"not_affected_if":["no-embedded-http-server","not-network-exposed"],"how_to_check":"- Check whether the project embeds OpenEJB by searching dependencies for `openejb`\n- Check whether the embedded HTTP server is reachable from untrusted networks","fix":"- The sources recommend blocking network access to the embedded HTTP server from untrusted clients\n- The sources recommend migrating to the Tomcat based TomEE distributions\n- No fixed version is stated in the sources","status":"open","published_at":"2026-11-10T16:17:26+00:00","first_seen_at":"2026-11-10T16:22:36+00:00","triaged_at":"2026-11-10T16:23:50+00:00","updated_at":"2026-11-10T16:23:50+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-10T16:23:50Z","model":"claude-haiku-5-5","output":{"fix":"- The sources recommend blocking network access to the embedded HTTP server from untrusted clients\n- The sources recommend migrating to the Tomcat based TomEE distributions\n- No fixed version is stated in the sources","reach":"internet","title":"OpenEJB embedded HTTP server lets remote users read arbitrary server files","impact":"medium","summary":"The embedded HTTP server in OpenEJB does not limit static resource requests to its configured directories. A remote unauthenticated attacker can read any file the server process can access.","audience":"businesses","category":"package","nicknames":[],"who_cares":["openejb","java","self-hosted"],"confidence":0.6,"fix_status":"none","needs_auth":"no","worst_case":"Remote attacker reads arbitrary files the server process can access","analyst_note":"Confirm affected OpenEJB version ranges and any fixed release at https://nvd.nist.gov/vuln/detail/CVE-2026-97881","how_to_check":"- Check whether the project embeds OpenEJB by searching dependencies for `openejb`\n- Check whether the embedded HTTP server is reachable from untrusted networks\n- unknown for affected version ranges, as the sources do not list them","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-embedded-http-server","not-network-exposed"],"who_is_affected":"Applications that run the embedded OpenEJB HTTP server and expose it to networks with untrusted clients are exposed. Systems that do not embed OpenEJB's HTTP server, or that keep it off untrusted networks, can skip it. The sources do not list affected versions.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000755,"input_tokens":4552,"output_tokens":599,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-97881':14A,17A 'access':52B,77C,88C 'arbitrari':9A,75C 'attack':43B,72C 'base':103C 'block':86C 'client':96C 'configur':38B,66C 'cve':12A,15A 'directori':39B,68C 'distribut':105C 'embed':2A,25B,54C,91C 'file':11A,47B,76C 'host':23B 'http':3A,26B,56C,92C 'java':18B 'let':5A 'limit':32B 'migrat':99C 'network':87C 'openejb':1A,19B,29B,55C 'packag':20B 'path':63C 'process':50B,81C 'read':8A,45B,74C 'recommend':84C 'remot':6A,41B,70C 'request':35B 'resourc':34B,62C,67C 'restrict':60C 'self':22B 'self-host':21B 'server':4A,10A,27B,49B,57C,80C,93C 'static':33B,61C 'tomcat':102C 'tome':104C 'unauthent':42B,71C 'untrust':95C 'user':7A,82C","nicknames":[],"mitigations":[],"who_affected":"Applications that run the embedded OpenEJB HTTP server and expose it to networks with untrusted clients are exposed. Systems that do not embed OpenEJB's HTTP server, or that keep it off untrusted networks, can skip it. The sources do not list affected versions.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","java","openejb","package","selfhosted"],"campaign_type":null,"search_a":"'-2026':13A,16A '-97881':14A,17A 'arbitrari':9A 'cve':12A,15A 'embed':2A 'file':11A 'http':3A 'let':5A 'openejb':1A 'read':8A 'remot':6A 'server':4A,10A 'user':7A","search_b":"'access':52B 'attack':43B 'configur':38B 'directori':39B 'embed':25B 'file':47B 'host':23B 'http':26B 'java':18B 'limit':32B 'openejb':19B,29B 'packag':20B 'process':50B 'read':45B 'remot':41B 'request':35B 'resourc':34B 'self':22B 'self-host':21B 'server':27B,49B 'static':33B 'unauthent':42B","search_c":"'access':77C,88C 'arbitrari':75C 'attack':72C 'base':103C 'block':86C 'client':96C 'configur':66C 'directori':68C 'distribut':105C 'embed':54C,91C 'file':76C 'http':56C,92C 'migrat':99C 'network':87C 'openejb':55C 'path':63C 'process':81C 'read':74C 'recommend':84C 'remot':70C 'resourc':62C,67C 'restrict':60C 'server':57C,80C,93C 'static':61C 'tomcat':102C 'tome':104C 'unauthent':71C 'untrust':95C 'user':82C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T16:17:26+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-97881","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97881","severity":null,"published_at":"2026-11-10T16:17:26+00:00","modified_at":"2026-11-10T16:17:26+00:00","first_seen_at":"2026-11-10T16:22:36+00:00","fetched_at":"2026-11-10T16:22:36+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}