{"api_version":"1","generated_at":"2026-11-11T06:53:11+00:00","cve":"CVE-2026-111249","urls":{"html":"https://cve.report/CVE-2026-111249","api":"https://cve.report/api/cve/CVE-2026-111249.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-111249","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-111249"},"summary":{"title":"Apache TomEE: Unauthenticated LiveReload endpoint reachable from the network","description":"The development-time LiveReload support listens on all network interfaces without authentication and accepts websocket connections from any origin. A network attacker, or a web page visited by the developer, can observe the names of changed files in the watched folder and the server version, and reach the deployed applications through the additional port. This only affects LiveReload enabled in the embedded Maven plugin. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.","state":"PUBLISHED","assigner":"apache","published_at":"2026-11-10 16:17:15","updated_at":"2026-11-10 16:17:15"},"problem_types":["CWE-1327","CWE-1327 CWE-1327 Binding to an Unrestricted IP Address"],"metrics":[],"references":[{"url":"https://lists.apache.org/thread/sssq84vj136dz964j1ooyr20jc9s6pnm","name":"https://lists.apache.org/thread/sssq84vj136dz964j1ooyr20jc9s6pnm","refsource":"security@apache.org","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-111249","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111249","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Apache Software Foundation","product":"Apache TomEE","version":"affected 7.0.0-M2 10.0.0-M1 semver","platforms":[]},{"source":"CNA","vendor":"Apache Software Foundation","product":"Apache TomEE","version":"affected 10.0.0-M1 10.3.0 semver","platforms":[]},{"source":"CNA","vendor":"Apache Software Foundation","product":"Apache TomEE","version":"affected 11.0.0-M1 11.0.0-M2 semver","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"The Apache Software Foundation","lang":"en"},{"source":"CNA","value":"Claude Security","lang":"en"},{"source":"CNA","value":"Richard Zowalla","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:livereload-tomee","packageURL":"pkg:maven/org.apache.tomee/livereload-tomee","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"7.0.0-M2","versionType":"semver"},{"lessThan":"10.3.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"lessThan":"11.0.0-M2","status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"credits":[{"lang":"en","type":"finder","value":"The Apache Software Foundation"},{"lang":"en","type":"tool","value":"Claude Security"},{"lang":"en","type":"remediation developer","value":"Richard Zowalla"}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"The development-time LiveReload support listens on all network interfaces without authentication and accepts websocket connections from any origin. A network attacker, or a web page visited by the developer, can observe the names of changed files in the watched folder and the server version, and reach the deployed applications through the additional port. This only affects LiveReload enabled in the embedded Maven plugin. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."}],"value":"The development-time LiveReload support listens on all network interfaces without authentication and accepts websocket connections from any origin. A network attacker, or a web page visited by the developer, can observe the names of changed files in the watched folder and the server version, and reach the deployed applications through the additional port. This only affects LiveReload enabled in the embedded Maven plugin. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."}],"metrics":[{"other":{"content":{"text":"low"},"type":"Textual description of severity"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-1327","description":"CWE-1327 Binding to an Unrestricted IP Address","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-10T15:22:18.798Z","orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache"},"references":[{"tags":["vendor-advisory"],"url":"https://lists.apache.org/thread/sssq84vj136dz964j1ooyr20jc9s6pnm"}],"source":{"discovery":"INTERNAL"},"title":"Apache TomEE: Unauthenticated LiveReload endpoint reachable from the network","x_generator":{"engine":"Vulnogram 1.0.3"}}},"cveMetadata":{"assignerOrgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","assignerShortName":"apache","cveId":"CVE-2026-111249","datePublished":"2026-11-10T15:22:18.798Z","dateReserved":"2026-10-15T18:36:39.603Z","dateUpdated":"2026-11-10T15:22:18.798Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-10 16:17:15","lastModifiedDate":"2026-11-10 16:17:15","problem_types":["CWE-1327","CWE-1327 CWE-1327 Binding to an Unrestricted IP Address"],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"111249","Ordinal":"1","Title":"Apache TomEE: Unauthenticated LiveReload endpoint reachable from","CVE":"CVE-2026-111249","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"111249","Ordinal":"1","NoteData":"The development-time LiveReload support listens on all network interfaces without authentication and accepts websocket connections from any origin. A network attacker, or a web page visited by the developer, can observe the names of changed files in the watched folder and the server version, and reach the deployed applications through the additional port. This only affects LiveReload enabled in the embedded Maven plugin. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.","Type":"Description","Title":"Apache TomEE: Unauthenticated LiveReload endpoint reachable from"}]}}}