CVE-2026-97870: Apache TomEE: Missing authentication for Hessian endpoints in embedded HTTP server

Published Nov 10, 2026

Updated

When Hessian remoting endpoints are served by the embedded HTTP server, configured authentication and transport security requirements are silently ignored. A remote unauthenticated attacker can invoke the exposed EJB methods without credentials or over an unencrypted connection. Only deployments that use the embedded HTTP server rather than Tomcat and rely on these settings are affected. Users are recommended to block network access to Hessian endpoints from untrusted clients, or to migrate to another remoting protocol.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Compensating control
Block network access to Apache TomEE Hessian remoting endpoints served by the embedded HTTP server from untrusted clients.
Compensating control
Migrate Apache TomEE remoting from Hessian endpoints to another remoting protocol.

Event History

Nov 10, 2026

CVE Published

via MITRE·03:34 PM

Data Sourced

via MITRE·03:34 PM

DescriptionWeakness

Frequently Asked Questions

Which deployments are affected?

Only deployments that serve Hessian remoting endpoints through the embedded HTTP server are affected. Deployments using Tomcat instead of the embedded HTTP server are not identified as affected by this issue.

What does an attacker need to exploit this?

A remote attacker needs network access to an exposed Hessian endpoint. No credentials are required, because configured authentication requirements are ignored.

What is the impact of the ignored transport-security requirement?

Hessian EJB methods may be invoked over an unencrypted connection even where transport security was configured. This exposes the remoting interface without the intended authentication or encrypted transport protections.

What can be done if patching is not immediately possible?

Block network access to Hessian endpoints from untrusted clients. Migrating to another remoting protocol is also recommended.

CVE-2026-97870: Apache TomEE: Missing authentication for Hessian endpoints in embedded HTTP server

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this?

What is the impact of the ignored transport-security requirement?

What can be done if patching is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this?

What is the impact of the ignored transport-security requirement?

What can be done if patching is not immediately possible?