# CVE-2026-111242: Apache Geronimo MicroProfile JWT authentication security state leak

Source: https://junglewise.ai/threats/cve-2026-111242-when-microprofile-jwt-authentication-is-used-for-servlets-that  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-111242 · Severity: info · Published 2026-11-10

Apache Geronimo, a Java application server, uses MicroProfile JWT for authentication in servlets with elevated privileges (run-as identity). When requests fail to complete normally, the authentication state is not properly cleared from the processing thread. An attacker with a valid JWT token can exploit this to cause subsequent unrelated requests to run with elevated privileges, potentially accessing or modifying protected resources.

Technologies: [Apache Geronimo](https://junglewise.ai/threats/technologies/geronimo). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-111242 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-111242 being exploited in the wild.

**How severe is CVE-2026-111242?** Informational severity, published 10 November 2026.

**Which products and versions are affected?** Apache Geronimo versions prior to 10.3.0 and 11.0.0-M2.

**Is there a fix for CVE-2026-111242?** Yes: fixed in Geronimo 10.3.0, 11.0.0-M2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-111242 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-111242?** Check whether you run Apache Geronimo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Geronimo 10.3.0, 11.0.0-M2

## Technical details

A security state cleanup flaw in Apache Geronimo's MicroProfile JWT authentication mechanism fails to clear the established security context when servlets with run-as identity declarations do not complete normally. An authenticated remote attacker can trigger abnormal request termination and then send subsequent requests on the same thread, which will inherit the elevated run-as identity and execute enterprise bean methods with those privileges. This is a thread-local state pollution vulnerability that affects authentication and authorization enforcement.

## Affected products

- Apache Geronimo versions prior to 10.3.0 and 11.0.0-M2

## Timeline

- 2026-11-10: disclosed

## References

- [https://repo.maven.apache.org/maven2](https://repo.maven.apache.org/maven2)
- [https://lists.apache.org/thread/opr1oob7p8xtqwcj1yv2dnsj4zqo9f03](https://lists.apache.org/thread/opr1oob7p8xtqwcj1yv2dnsj4zqo9f03)

## Related threats

- [Geronimo Hessian remoting security configuration bypass](https://junglewise.ai/threats/cve-2026-97870-when-hessian-remoting-endpoints-are-served-by-the-embedded-http)
- [Apache Geronimo EJB authentication bypass in remote deployment](https://junglewise.ai/threats/cve-2026-87756-the-internal-system-ejbs-used-for-remote-deployment-and)