unscored
CVE-2026-97867
The EJBd remote protocol returns datasource connection details, including database credentials, to remote clients that look up a datasource.
Impact
The EJBd remote protocol returns datasource connection details, including database credentials, to remote clients that look up a datasource. A remote client able to reach the EJBd endpoint can obtain the database credentials and connect to the database directly. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
Affected products · Apache Software Foundation
| Product | Affected versions |
|---|---|
| Apache TomEE | from 4.0.0-beta-1 through 4.7.5 from 7.0.0-M1 before 10.0.0-M1 from 10.0.0-M1 before 10.3.0 from 11.0.0-M1 before 11.0.0-M2 Version 4.0.0-beta-1 ≤4.7.5 |