---
id: "CVE-2026-97881"
page: "https://infrastack.ai/live/CVE-2026-97881"
kind: "vulnerability"
aliases: ["CVE-2026-97881"]
title: "OpenEJB embedded HTTP server lets remote users read arbitrary server files"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["java", "openejb", "package", "self-hosted"]
not_affected_if: ["no-embedded-http-server", "not-network-exposed"]
published_at: "2026-11-10T16:17:26+00:00"
first_seen_at: "2026-11-10T16:22:36+00:00"
updated_at: "2026-11-10T16:23:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97881", "first_seen_at": "2026-11-10T16:22:36+00:00"}]
exploit_sources: []
---

# OpenEJB embedded HTTP server lets remote users read arbitrary server files

Link for people: https://infrastack.ai/live/CVE-2026-97881 (this .md is for agents)

The embedded HTTP server in OpenEJB does not limit static resource requests to its configured directories. A remote unauthenticated attacker can read any file the server process can access.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the project embeds OpenEJB by searching dependencies for `openejb`
- Check whether the embedded HTTP server is reachable from untrusted networks

## Fix

- The sources recommend blocking network access to the embedded HTTP server from untrusted clients
- The sources recommend migrating to the Tomcat based TomEE distributions
- No fixed version is stated in the sources

## Timeline

- 2026-11-10T16:22:36+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-97881

## From the sources

The embedded OpenEJB HTTP server does not restrict static resource paths to the configured resource directories. A remote unauthenticated attacker can read arbitrary files accessible to the server process. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_