{"id":"CVE-2026-97888","kind":"vulnerability","aliases":["CVE-2026-97888"],"related":[],"title":"Embedded HTTP server leaks prior user's identity to next unauthenticated request","description":"The embedded HTTP server does not clear the security identity established during a request before its worker thread handles the next request. A remote unauthenticated attacker can have their request processed with the identity of a previously authenticated user, gaining that user's privileges. Only applications served by the embedded HTTP server that authenticate programmatically or via basic authentication are affected. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions.","summary":"The embedded HTTP server does not clear a request's security identity before its worker thread serves the next request. A remote unauthenticated attacker can get their request handled with the privileges of a previously authenticated user.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded-http-server","java","other","tomee"],"not_affected_if":["network-restricted","no-basic-auth","no-programmatic-auth"],"how_to_check":"- Check whether the application runs on the embedded HTTP server (unknown from the sources which product this is)\n- Check whether the application authenticates programmatically or with basic authentication, as the sources say only those are affected","fix":"- Move to the Tomcat based TomEE distributions, as a source recommends\n- Block network access to the embedded HTTP server from untrusted clients, as a source recommends\n- No fixed version stated in the sources","status":"open","published_at":"2026-11-10T16:17:27+00:00","first_seen_at":"2026-11-10T16:22:36+00:00","triaged_at":"2026-11-10T16:23:50+00:00","updated_at":"2026-11-10T16:23:50+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-10T16:23:50Z","model":"claude-haiku-5-5","output":{"fix":"- Move to the Tomcat based TomEE distributions, as a source recommends\n- Block network access to the embedded HTTP server from untrusted clients, as a source recommends\n- No fixed version stated in the sources","reach":"internet","title":"Embedded HTTP server leaks prior user's identity to next unauthenticated request","impact":"high","summary":"The embedded HTTP server does not clear a request's security identity before its worker thread serves the next request. A remote unauthenticated attacker can get their request handled with the privileges of a previously authenticated user.","audience":"businesses","category":"other","nicknames":[],"who_cares":["embedded-http-server","java","tomee"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Remote attacker gains another user's privileges on the application","analyst_note":"Identify the affected product and fixed versions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-97888; sources give no product ranges.","how_to_check":"- Check whether the application runs on the embedded HTTP server (unknown from the sources which product this is)\n- Check whether the application authenticates programmatically or with basic authentication, as the sources say only those are affected\n- unknown for exact version ranges, as the sources do not list products","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-programmatic-auth","no-basic-auth","network-restricted"],"who_is_affected":"Only applications served by the embedded HTTP server that authenticate programmatically or via basic authentication are affected. A remote attacker without credentials can be handled under a previous user's identity, so exposed instances on untrusted networks are the main concern. Systems not using the embedded server, or not using those authentication methods, can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000783,"input_tokens":4595,"output_tokens":647,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-97888':15A,18A 'access':130C 'affect':123C 'applic':108C 'attack':49B,88C 'authent':61B,100C,116C,121C 'base':145C 'basic':120C 'block':128C 'clear':32B,69C 'client':138C 'cve':13A,16A 'distribut':147C 'embed':1A,20B,27B,64C,112C,133C 'embedded-http-serv':19B 'establish':73C 'gain':102C 'get':51B 'handl':54B,81C 'http':2A,21B,28B,65C,113C,134C 'ident':8A,37B,72C,96C 'java':23B 'leak':4A 'migrat':141C 'network':129C 'next':10A,44B,83C 'previous':60B,99C 'prior':5A 'privileg':57B,106C 'process':93C 'programmat':117C 'recommend':126C 'remot':47B,86C 'request':12A,34B,45B,53B,76C,84C,92C 'secur':36B,71C 'serv':42B,109C 'server':3A,22B,29B,66C,114C,135C 'thread':41B,80C 'tomcat':144C 'tome':25B,146C 'unauthent':11A,48B,87C 'untrust':137C 'user':6A,62B,101C,104C,124C 'via':119C 'worker':40B,79C","nicknames":[],"mitigations":[],"who_affected":"Only applications served by the embedded HTTP server that authenticate programmatically or via basic authentication are affected. A remote attacker without credentials can be handled under a previous user's identity, so exposed instances on untrusted networks are the main concern. Systems not using the embedded server, or not using those authentication methods, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["embeddedhttpserver","high","java","other","tomee"],"campaign_type":null,"search_a":"'-2026':14A,17A '-97888':15A,18A 'cve':13A,16A 'embed':1A 'http':2A 'ident':8A 'leak':4A 'next':10A 'prior':5A 'request':12A 'server':3A 'unauthent':11A 'user':6A","search_b":"'attack':49B 'authent':61B 'clear':32B 'embed':20B,27B 'embedded-http-serv':19B 'get':51B 'handl':54B 'http':21B,28B 'ident':37B 'java':23B 'next':44B 'previous':60B 'privileg':57B 'remot':47B 'request':34B,45B,53B 'secur':36B 'serv':42B 'server':22B,29B 'thread':41B 'tome':25B 'unauthent':48B 'user':62B 'worker':40B","search_c":"'access':130C 'affect':123C 'applic':108C 'attack':88C 'authent':100C,116C,121C 'base':145C 'basic':120C 'block':128C 'clear':69C 'client':138C 'distribut':147C 'embed':64C,112C,133C 'establish':73C 'gain':102C 'handl':81C 'http':65C,113C,134C 'ident':72C,96C 'migrat':141C 'network':129C 'next':83C 'previous':99C 'privileg':106C 'process':93C 'programmat':117C 'recommend':126C 'remot':86C 'request':76C,84C,92C 'secur':71C 'serv':109C 'server':66C,114C,135C 'thread':80C 'tomcat':144C 'tome':146C 'unauthent':87C 'untrust':137C 'user':101C,104C,124C 'via':119C 'worker':79C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T16:17:27+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-97888","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97888","severity":null,"published_at":"2026-11-10T16:17:27+00:00","modified_at":"2026-11-10T16:17:27+00:00","first_seen_at":"2026-11-10T16:22:36+00:00","fetched_at":"2026-11-10T16:22:36+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}