CVE-2026-97867 PUBLISHED

Apache TomEE: Database credential disclosure via remote JNDI lookup

Assigner: apache
Reserved: 25.09.2026 Published: 10.11.2026 Updated: 10.11.2026

The EJBd remote protocol returns datasource connection details, including database credentials, to remote clients that look up a datasource. A remote client able to reach the EJBd endpoint can obtain the database credentials and connect to the database directly. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.

Product Status

Vendor Apache Software Foundation
Product Apache TomEE
Versions Default: unaffected
  • affected from 4.0.0-beta-1 to 4.7.5 (incl.)
Vendor Apache Software Foundation
Product Apache TomEE
Versions Default: unaffected
  • affected from 7.0.0-M1 to 10.0.0-M1 (excl.)
  • affected from 10.0.0-M1 to 10.3.0 (excl.)
  • affected from 11.0.0-M1 to 11.0.0-M2 (excl.)

Credits

  • The Apache Software Foundation finder
  • Claude Security tool
  • Markus Jung remediation developer

References

Problem Types

  • CWE-522 Insufficiently Protected Credentials CWE