CVE-2026-111249
Apache TomEE: Unauthenticated LiveReload endpoint reachable from the network
Description
The development-time LiveReload support listens on all network interfaces without authentication and accepts websocket connections from any origin. A network attacker, or a web page visited by the developer, can observe the names of changed files in the watched folder and the server version, and reach the deployed applications through the additional port. This only affects LiveReload enabled in the embedded Maven plugin. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
INFO
Published Date :
Nov. 10, 2026, 3:22 p.m.
Last Modified :
Nov. 10, 2026, 3:22 p.m.
Remotely Exploit :
No
Source :
apache
Solution
- Upgrade LiveReload to version 10.3.0 or 11.0.0-M2.
- Disable LiveReload if not actively developing.
- Restrict network access to LiveReload port.
- Ensure LiveReload uses authenticated connections.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-111249 vulnerability anywhere in the article.