CVE-2026-97867: Apache TomEE: Database credential disclosure via remote JNDI lookup

Published Nov 10, 2026

Updated

The EJBd remote protocol returns datasource connection details, including database credentials, to remote clients that look up a datasource. A remote client able to reach the EJBd endpoint can obtain the database credentials and connect to the database directly. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache TomEE to a version that resolves this vulnerability.
Fixed in 10.3.0
Upgrade
Upgrade Apache TomEE to a version that resolves this vulnerability.
Fixed in 11.0.0-M2

Event History

Nov 10, 2026

CVE Published

via MITRE·03:36 PM

Data Sourced

via MITRE·03:36 PM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

Any remote client that can reach the EJBd endpoint and perform a datasource lookup can retrieve datasource connection details, including database credentials.

What is the impact after credentials are disclosed?

An attacker can use the disclosed database credentials to connect directly to the database.

Which versions address the issue?

Upgrade to Apache TomEE 10.3.0 or 11.0.0-M2, which fix the issue.

CVE-2026-97867: Apache TomEE: Database credential disclosure via remote JNDI lookup

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What is the impact after credentials are disclosed?

Which versions address the issue?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is the impact after credentials are disclosed?

Which versions address the issue?