Apache TomEE: Unauthenticated LiveReload endpoint reachable from the network
Summary
| CVE | CVE-2026-111249 |
|---|---|
| State | PUBLISHED |
| Assigner | apache |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-11-10 16:17:15 UTC |
| Updated | 2026-11-10 16:17:15 UTC |
| Description | The development-time LiveReload support listens on all network interfaces without authentication and accepts websocket connections from any origin. A network attacker, or a web page visited by the developer, can observe the names of changed files in the watched folder and the server version, and reach the deployed applications through the additional port. This only affects LiveReload enabled in the embedded Maven plugin. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue. |
Risk And Classification
Problem Types: CWE-1327 | CWE-1327 CWE-1327 Binding to an Unrestricted IP Address
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Apache Software Foundation | Apache TomEE | affected 7.0.0-M2 10.0.0-M1 semver | Not specified |
| CNA | Apache Software Foundation | Apache TomEE | affected 10.0.0-M1 10.3.0 semver | Not specified |
| CNA | Apache Software Foundation | Apache TomEE | affected 11.0.0-M1 11.0.0-M2 semver | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| lists.apache.org/thread/sssq84vj136dz964j1ooyr20jc9s6pnm | [email protected] | lists.apache.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: The Apache Software Foundation (en)
CNA: Claude Security (en)
CNA: Richard Zowalla (en)
There are currently no legacy QID mappings associated with this CVE.