CVE-2026-97870
Apache TomEE: Missing authentication for Hessian endpoints in embedded HTTP server
When Hessian remoting endpoints are served by the embedded HTTP server, configured authentication and transport security requirements are silently ignored. A remote unauthenticated attacker can invoke the exposed EJB methods without credentials or over an unencrypted connection. Only deployments that use the embedded HTTP server rather than Tomcat and rely on these settings are affected. Users are recommended to block network access to Hessian endpoints from untrusted clients, or to migrate to another remoting protocol.
What each source reports
CVE List No score
Apache TomEE: Missing authentication for Hessian endpoints in embedded HTTP server
When Hessian remoting endpoints are served by the embedded HTTP server, configured authentication and transport security requirements are silently ignored. A remote unauthenticated attacker can invoke the exposed EJB methods without credentials or over an unencrypted connection. Only deployments that use the embedded HTTP server rather than Tomcat and rely on these settings are affected. Users are recommended to block network access to Hessian endpoints from untrusted clients, or to migrate to another remoting protocol.
- Record
CVE-2026-97870- Weakness
- CWE-306
- Updated
- 2026-11-10
EUVDEUVD-2026-121158 No score
When Hessian remoting endpoints are served by the embedded HTTP server, configured authentication and transport security requirements are silently ignored. A remote unauthenticated attacker can invoke the exposed EJB methods without credentials or over an unencrypted connection. Only deployments that use the embedded HTTP server rather than Tomcat and rely on these settings are affected. Users are recommended to block network access to Hessian endpoints from untrusted clients, or to migrate to another remoting protocol.
- Record
EUVD-2026-121158- Updated
- 2026-11-10
GitHub AdvisoriesGHSA-q8gf-xr42-349r No score
When Hessian remoting endpoints are served by the embedded HTTP server, configured authentication...
When Hessian remoting endpoints are served by the embedded HTTP server, configured authentication and transport security requirements are silently ignored. A remote unauthenticated attacker can invoke the exposed EJB methods without credentials or over an unencrypted connection. Only deployments that use the embedded HTTP server rather than Tomcat and rely on these settings are affected. Users are recommended to block network access to Hessian endpoints from untrusted clients, or to migrate to another remoting protocol.
- Record
GHSA-q8gf-xr42-349r- Weakness
- CWE-306
- Updated
- 2026-11-10
NVD No score
When Hessian remoting endpoints are served by the embedded HTTP server, configured authentication and transport security requirements are silently ignored. A remote unauthenticated attacker can invoke the exposed EJB methods without credentials or over an unencrypted connection. Only deployments that use the embedded HTTP server rather than Tomcat and rely on these settings are affected. Users are recommended to block network access to Hessian endpoints from untrusted clients, or to migrate to another remoting protocol.
- Record
CVE-2026-97870- Weakness
- CWE-306
- Updated
- 2026-11-10
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| published | EUVD | |
| published | EUVD | |
| aliases, references | GitHub Advisories, NVD | |
| cwes, references, title | CVE List | |
| first indexed | EUVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-97870 is a vulnerability with no CVSS score yet in Apache Software Foundation Tomee, published November 10, 2026. No source lists public exploit code. No source names a fixed version.