{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-111257", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-10-15T18:59:32.765Z", "datePublished": "2026-11-10T15:19:32.452Z", "dateUpdated": "2026-11-10T15:19:32.452Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-11-10T15:19:32.452Z"}, "title": "Apache TomEE: Well-known administrative credentials created at startup", "problemTypes": [{"descriptions": [{"description": "CWE-1392 Use of Default Credentials", "lang": "en", "cweId": "CWE-1392", "type": "CWE"}]}], "source": {"discovery": "INTERNAL"}, "affected": [{"vendor": "Apache Software Foundation", "product": "Apache TomEE", "collectionURL": "https://repo.maven.apache.org/maven2", "packageName": "org.apache.openejb:tomee-catalina", "packageURL": "pkg:maven/org.apache.openejb/tomee-catalina", "versions": [{"status": "affected", "version": "1.5.1", "lessThanOrEqual": "1.7.5", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Apache Software Foundation", "product": "Apache TomEE", "collectionURL": "https://repo.maven.apache.org/maven2", "packageName": "org.apache.tomee:tomee-catalina", "packageURL": "pkg:maven/org.apache.tomee/tomee-catalina", "versions": [{"status": "affected", "version": "7.0.0-M1", "lessThan": "10.0.0-M1", "versionType": "semver"}, {"status": "affected", "version": "10.0.0-M1", "lessThan": "10.3.0", "versionType": "semver"}, {"status": "affected", "version": "11.0.0-M1", "lessThan": "11.0.0-M2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"value": "With the default configuration and no users defined in the default user database, TomEE silently adds an administrative user with a well-known password at startup. A remote attacker can use these credentials to authenticate to web applications that use the default realm and grant access to any authenticated user or to the TomEE administrative role. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.", "lang": "en", "supportingMedia": [{"type": "text/html", "base64": false, "value": "With the default configuration and no users defined in the default user database, TomEE silently adds an administrative user with a well-known password at startup. A remote attacker can use these credentials to authenticate to web applications that use the default realm and grant access to any authenticated user or to the TomEE administrative role. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."}]}], "references": [{"url": "https://lists.apache.org/thread/gzzn7jbzrfk8bo9ttmqhr3c6q3szc5vf", "tags": ["vendor-advisory"]}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "important"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "credits": [{"lang": "en", "value": "The Apache Software Foundation", "type": "finder"}, {"lang": "en", "value": "Claude Security", "type": "tool"}, {"lang": "en", "value": "Markus Jung", "type": "remediation developer"}], "x_generator": {"engine": "Vulnogram 1.0.3"}}}}

{}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "org.apache.openejb:tomee-catalina", "packageURL": "pkg:maven/org.apache.openejb/tomee-catalina", "product": "Apache TomEE", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "1.7.5", "status": "affected", "version": "1.5.1", "versionType": "semver"}]}, {"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "org.apache.tomee:tomee-catalina", "packageURL": "pkg:maven/org.apache.tomee/tomee-catalina", "product": "Apache TomEE", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "10.0.0-M1", "status": "affected", "version": "7.0.0-M1", "versionType": "semver"}, {"lessThan": "10.3.0", "status": "affected", "version": "10.0.0-M1", "versionType": "semver"}, {"lessThan": "11.0.0-M2", "status": "affected", "version": "11.0.0-M1", "versionType": "semver"}]}], "source": "security@apache.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "With the default configuration and no users defined in the default user database, TomEE silently adds an administrative user with a well-known password at startup. A remote attacker can use these credentials to authenticate to web applications that use the default realm and grant access to any authenticated user or to the TomEE administrative role. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."}], "id": "CVE-2026-111257", "lastModified": "2026-11-10T16:17:16.343", "metrics": {}, "published": "2026-11-10T16:17:16.343", "references": [{"source": "security@apache.org", "url": "https://lists.apache.org/thread/gzzn7jbzrfk8bo9ttmqhr3c6q3szc5vf"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1392"}], "source": "security@apache.org", "type": "Primary"}]}

{}

{}