{"id":"CVE-2026-97867","aliases":[],"cve":{"records":[{"id":"CVE-2026-97867","source":"apache","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-25T08:23:52.192Z","published":"2026-11-10T15:36:00.698Z","modified":"2026-11-10T15:36:00.698Z"}],"publishers":[{"name":"apache","role":"CNA","organizationId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","modified":"2026-11-10T15:36:00.698Z"}],"references":[{"url":"https://lists.apache.org/thread/f6nqckc3wgqnnsrkb1hd640o3k4omfvr","tags":["vendor-advisory"],"source":"apache"}],"weaknesses":[{"id":"CWE-522","description":"CWE-522 Insufficiently Protected Credentials","source":"apache"}],"applicability":[],"prioritization":[]},"title":"Apache TomEE: Database credential disclosure via remote JNDI lookup","titleSource":"apache","descriptionSource":"apache","description":"The EJBd remote protocol returns datasource connection details, including database credentials, to remote clients that look up a datasource. A remote client able to reach the EJBd endpoint can obtain the database credentials and connect to the database directly. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.","score":null,"severity":"unknown","published":"2026-11-10T15:36:00.698Z","modified":"2026-11-10T15:36:00.698Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Apache Software Foundation","name":"Apache TomEE","platforms":[],"versions":[{"version":"4.0.0-beta-1","status":"affected","lessThanOrEqual":"4.7.5","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:maven/org.apache.openejb/openejb-ejbd","packageIdentity":{"ecosystem":"Maven","name":"org.apache.openejb:openejb-ejbd"},"cpes":[],"source":"apache","url":"https://www.cve.org/CVERecord?id=CVE-2026-97867"},{"vendor":"Apache Software Foundation","name":"Apache TomEE","platforms":[],"versions":[{"version":"7.0.0-M1","status":"affected","lessThan":"10.0.0-M1","versionType":"semver"},{"version":"10.0.0-M1","status":"affected","lessThan":"10.3.0","versionType":"semver"},{"version":"11.0.0-M1","status":"affected","lessThan":"11.0.0-M2","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:maven/org.apache.tomee/openejb-ejbd","packageIdentity":{"ecosystem":"Maven","name":"org.apache.tomee:openejb-ejbd"},"cpes":[],"source":"apache","url":"https://www.cve.org/CVERecord?id=CVE-2026-97867"}],"remediation":[],"references":["https://lists.apache.org/thread/f6nqckc3wgqnnsrkb1hd640o3k4omfvr"],"sources":[{"name":"CVE","id":"CVE-2026-97867","modified":"2026-11-10T15:36:00.698Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-97867"}],"assessments":[],"sourceAffected":[],"observedAt":"2026-11-10T15:46:15.820Z","kev":{"status":"not-listed","checkedAt":"2026-11-14T21:20:32.434Z"},"coverage":[{"source":"NVD","status":"no-result","checkedAt":"2026-11-10T15:50:34.894Z","attemptedAt":"2026-11-10T15:50:34.894Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-10T15:50:34.986Z","attemptedAt":"2026-11-10T15:50:34.986Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-11-10T15:50:34.316Z","attemptedAt":"2026-11-10T15:50:34.316Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-10T15:50:34.849Z","attemptedAt":"2026-11-10T15:50:34.849Z"}],"evidence":[],"aiSummary":{"text":"Apache TomEE versions up to 4.7.5, 7.0.0-M1 to 10.0.0-M1, and 11.0.0-M1 to 11.0.0-M2 may disclose database credentials to remote clients via JNDI lookup. A remote client can obtain credentials and connect to the database directly. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-10T15:51:13.994Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-97867"}]}}