Remote Protocol Vulnerability in EJBd Affecting Apache Software Foundation
CVE-2026-97867

Currently unrated

Key Information:

Vendor

Apache
Status
Apache Tomee
Vendor
CVE Published:
10 November 2026

What is CVE-2026-97867?

The EJBd remote protocol is susceptible to security risks that allow unauthorized remote clients to retrieve sensitive datasource connection information, including database credentials. When a remote client connects to the EJBd endpoint, it can exploit this vulnerability to access the database directly, which poses significant risks for data security. Users should update to EJBd version 10.3.0 or 11.0.0-M2 to mitigate this risk effectively.

Affected Version(s)

Apache TomEE 4.0.0-beta-1 <= 4.7.5

Apache TomEE 7.0.0-M1 < 10.0.0-M1

Apache TomEE 10.0.0-M1 < 10.3.0

References

https://lists.apache.org/thread/f6nqckc3wgqnnsrkb1hd640o3...
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

The Apache Software Foundation
Claude Security
Markus Jung
.