CVE-2026-97881

The embedded OpenEJB HTTP server does not restrict static resource paths to the configured resource directories. A remote unauthenticated attacker can read arbitrary files accessible to the server process. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions.

• CWE-22

• https://lists.apache.org/thread/pptsyzp963c01nmss9hn7p68pthzdnp9

Published

Nov 10, 2026

Last Modified

Nov 12, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-97875Rojo's "rojo serve" HTTP API (default port 34872) has no Hos…8.1
• CVE-2026-97876A local attacker with control over GRUB's configuration can …6.4
• CVE-2026-97877A vulnerability was determined in zhistaredu StarTraining up…7.3
• CVE-2026-97878A vulnerability was identified in zhistaredu StarTraining up…7.3
• CVE-2026-97879A security flaw has been discovered in zhistaredu StarTraini…5.3
• CVE-2026-97880The embedded OpenEJB HTTP server dispatches some requests to…
• CVE-2026-97882A weakness has been identified in mathurvishal CloudClassroo…7.3
• CVE-2026-97883A security vulnerability has been detected in mathurvishal C…7.3
• CVE-2026-97884A vulnerability was detected in mathurvishal CloudClassroom-…6.3
• CVE-2026-97885A flaw has been found in mathurvishal CloudClassroom-PHP-Pro…7.3
• CVE-2026-97886A vulnerability has been found in mathurvishal CloudClassroo…6.3
• CVE-2026-97888The embedded HTTP server does not clear the security identit…