---
id: "CVE-2026-97888"
page: "https://infrastack.ai/live/CVE-2026-97888"
kind: "vulnerability"
aliases: ["CVE-2026-97888"]
title: "Embedded HTTP server leaks prior user's identity to next unauthenticated request"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["embedded-http-server", "java", "other", "tomee"]
not_affected_if: ["network-restricted", "no-basic-auth", "no-programmatic-auth"]
published_at: "2026-11-10T16:17:27+00:00"
first_seen_at: "2026-11-10T16:22:36+00:00"
updated_at: "2026-11-10T16:23:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97888", "first_seen_at": "2026-11-10T16:22:36+00:00"}]
exploit_sources: []
---

# Embedded HTTP server leaks prior user's identity to next unauthenticated request

Link for people: https://infrastack.ai/live/CVE-2026-97888 (this .md is for agents)

The embedded HTTP server does not clear a request's security identity before its worker thread serves the next request. A remote unauthenticated attacker can get their request handled with the privileges of a previously authenticated user.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the application runs on the embedded HTTP server (unknown from the sources which product this is)
- Check whether the application authenticates programmatically or with basic authentication, as the sources say only those are affected

## Fix

- Move to the Tomcat based TomEE distributions, as a source recommends
- Block network access to the embedded HTTP server from untrusted clients, as a source recommends
- No fixed version stated in the sources

## Timeline

- 2026-11-10T16:22:36+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-97888

## From the sources

The embedded HTTP server does not clear the security identity established during a request before its worker thread handles the next request. A remote unauthenticated attacker can have their request processed with the identity of a previously authenticated user, gaining that user's privileges. Only applications served by the embedded HTTP server that authenticate programmatically or via basic authentication are affected. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_