Apache
CVE-2026-111257: With the default configuration and no users defined in the default user database, TomEE silently adds an administrative user with a well-known password at start
CVE-2026-111257 Nov 10, 2026 Source: Vendor
In brief. Apache published CVE-2026-111257: With the default configuration and no users defined in the default user database, TomEE silently adds an administrative user with a well-known password at start on November 10, 2026. It credits 1 researcher or team for 1 CVE.
With the default configuration and no users defined in the default user database, TomEE silently adds an administrative user with a well-known password at startup. A remote attacker can use these credentials to authenticate to web applications that use the default realm and grant access to any authenticated user or to the TomEE administrative role. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://nvd.nist.gov/vuln/detail/CVE-2026-111257
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
1 line
Showing 1–1 of 1