CVE-2026-111249: Apache TomEE: Unauthenticated LiveReload endpoint reachable from the network
Published Nov 10, 2026
·Updated
The development-time LiveReload support listens on all network interfaces without authentication and accepts websocket connections from any origin. A network attacker, or a web page visited by the developer, can observe the names of changed files in the watched folder and the server version, and reach the deployed applications through the additional port. This only affects LiveReload enabled in the embedded Maven plugin. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache TomEEto a version that resolves this vulnerability.Fixed in 10.3.0 - Upgrade
Upgrade
Apache TomEEto a version that resolves this vulnerability.Fixed in 11.0.0-M2
Event History
Nov 10, 2026
CVE Published
via MITRE·03:22 PM
Data Sourced
via MITRE·03:22 PM
DescriptionWeakness