CVE-2026-97867 - Vulnerability Details - OpenCVE

The EJBd remote protocol returns datasource connection details, including database credentials, to remote clients that look up a datasource. A remote client able to reach the EJBd endpoint can obtain the database credentials and connect to the database directly. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Apache Software Foundation

Apache TomEE

unaffected

Version	Status	Constraints
`4.0.0-beta-1`	affected	≤ 4.7.5

Apache Software Foundation

Apache TomEE

unaffected

Version	Status	Constraints
`7.0.0-M1`	affected	< 10.0.0-M1
`10.0.0-M1`	affected	< 10.3.0
`11.0.0-M1`	affected	< 11.0.0-M2

No data.

No data.

No data.

Project Subscriptions

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://lists.apache.org/thread/f6nqckc3wgqnnsrkb1hd640o3k4omfvr

History

Tue, 10 Nov 2026 15:45:00 +0000

Type	Values Removed	Values Added
Description		The EJBd remote protocol returns datasource connection details, including database credentials, to remote clients that look up a datasource. A remote client able to reach the EJBd endpoint can obtain the database credentials and connect to the database directly. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
Title		Apache TomEE: Database credential disclosure via remote JNDI lookup
Weaknesses		CWE-522
References		https://lists.apache.org/thread/f6nqckc3wgqnnsrkb1hd640o3k4omfvr

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: apache

Published: 2026-11-10T15:36:00.698Z

Updated: 2026-11-10T15:36:00.698Z

Reserved: 2026-09-25T08:23:52.192Z

Link: CVE-2026-97867

Vulnrichment

No data.

NVD

No data.

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-522

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-97867", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-09-25T08:23:52.192Z", "datePublished": "2026-11-10T15:36:00.698Z", "dateUpdated": "2026-11-10T15:36:00.698Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-11-10T15:36:00.698Z"}, "title": "Apache TomEE: Database credential disclosure via remote JNDI lookup", "problemTypes": [{"descriptions": [{"description": "CWE-522 Insufficiently Protected Credentials", "lang": "en", "cweId": "CWE-522", "type": "CWE"}]}], "source": {"discovery": "INTERNAL"}, "affected": [{"vendor": "Apache Software Foundation", "product": "Apache TomEE", "collectionURL": "https://repo.maven.apache.org/maven2", "packageName": "org.apache.openejb:openejb-ejbd", "packageURL": "pkg:maven/org.apache.openejb/openejb-ejbd", "versions": [{"status": "affected", "version": "4.0.0-beta-1", "lessThanOrEqual": "4.7.5", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Apache Software Foundation", "product": "Apache TomEE", "collectionURL": "https://repo.maven.apache.org/maven2", "packageName": "org.apache.tomee:openejb-ejbd", "packageURL": "pkg:maven/org.apache.tomee/openejb-ejbd", "versions": [{"status": "affected", "version": "7.0.0-M1", "lessThan": "10.0.0-M1", "versionType": "semver"}, {"status": "affected", "version": "10.0.0-M1", "lessThan": "10.3.0", "versionType": "semver"}, {"status": "affected", "version": "11.0.0-M1", "lessThan": "11.0.0-M2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"value": "The EJBd remote protocol returns datasource connection details, including database credentials, to remote clients that look up a datasource. A remote client able to reach the EJBd endpoint can obtain the database credentials and connect to the database directly. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.", "lang": "en", "supportingMedia": [{"type": "text/html", "base64": false, "value": "The EJBd remote protocol returns datasource connection details, including database credentials, to remote clients that look up a datasource. A remote client able to reach the EJBd endpoint can obtain the database credentials and connect to the database directly. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."}]}], "references": [{"url": "https://lists.apache.org/thread/f6nqckc3wgqnnsrkb1hd640o3k4omfvr", "tags": ["vendor-advisory"]}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "moderate"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "credits": [{"lang": "en", "value": "The Apache Software Foundation", "type": "finder"}, {"lang": "en", "value": "Claude Security", "type": "tool"}, {"lang": "en", "value": "Markus Jung", "type": "remediation developer"}], "x_generator": {"engine": "Vulnogram 1.0.3"}}}}