CVE-2026-111257
Apache TomEE: Well-known administrative credentials created at startup
Description
With the default configuration and no users defined in the default user database, TomEE silently adds an administrative user with a well-known password at startup. A remote attacker can use these credentials to authenticate to web applications that use the default realm and grant access to any authenticated user or to the TomEE administrative role. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
INFO
Published Date :
Nov. 10, 2026, 3:19 p.m.
Last Modified :
Nov. 10, 2026, 3:19 p.m.
Remotely Exploit :
No
Source :
apache
Solution
- Upgrade TomEE to version 10.3.0 or later.
- Upgrade TomEE to version 11.0.0-M2 or later.
- Disable or remove the default user database.
- Configure a strong password for the administrative user.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-111257 vulnerability anywhere in the article.