# CVE-2026-97888: Apache OpenEJB embedded HTTP server privilege escalation via thread identity reuse

Source: https://junglewise.ai/threats/cve-2026-97888-the-embedded-http-server-does-not-clear-the-security-identity  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-97888 · Severity: info · Published 2026-11-10

OpenEJB's embedded HTTP server fails to clear authentication credentials between requests processed by the same worker thread. An unauthenticated attacker can send a request after an authenticated user and inherit that user's privileges, potentially accessing sensitive data or performing unauthorized actions. This affects applications using the embedded HTTP server with programmatic or basic authentication. Organizations should restrict network access to the embedded HTTP server or migrate to Tomcat-based TomEE distributions.

Technologies: [Apache OpenEJB](https://junglewise.ai/threats/technologies/openejb). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-97888 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-97888 being exploited in the wild.

**How severe is CVE-2026-97888?** Informational severity, published 10 November 2026.

**Which products and versions are affected?** Apache OpenEJB.

**Is there a fix for CVE-2026-97888?** No fixed version is recorded yet. Block network access to the embedded HTTP server from untrusted clients, or migrate to the Tomcat-based TomEE distributions which do not have this vulnerability. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-97888 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-97888?** Check whether you run Apache OpenEJB. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Block network access to the embedded HTTP server from untrusted clients, or migrate to the Tomcat-based TomEE distributions which do not have this vulnerability.

## Technical details

The embedded HTTP server in Apache OpenEJB does not clear the security identity context after processing an authenticated request before reusing the worker thread for the next request. An unauthenticated remote attacker can craft a request following an authenticated user's request on the same thread, causing their request to execute with the previous user's privileges. Only applications using programmatic or HTTP basic authentication are affected.

## Affected products

- Apache OpenEJB

## Timeline

- 2026-11-10: disclosed

## References

- [https://repo.maven.apache.org/maven2](https://repo.maven.apache.org/maven2)
- [https://lists.apache.org/thread/7snc0d5bd2hvk1416v5b34pjgn0mmdvn](https://lists.apache.org/thread/7snc0d5bd2hvk1416v5b34pjgn0mmdvn)

## Related threats

- [Apache OpenEJB path traversal in HTTP server](https://junglewise.ai/threats/cve-2026-97881-the-embedded-openejb-http-server-does-not-restrict-static)
- [Apache OpenEJB HTTP server authentication bypass in REST endpoints](https://junglewise.ai/threats/cve-2026-97880-the-embedded-openejb-http-server-dispatches-some-requests-to-rest)
- [Apache OpenEJB HTTP server resource exhaustion](https://junglewise.ai/threats/cve-2026-86531-the-embedded-openejb-http-server-does-not-limit-the-size-of)
- [Apache OpenEJB authentication bypass in embedded HTTP server](https://junglewise.ai/threats/cve-2026-111256-when-jax-ws-or-jax-rs-endpoints-are-published-by-the-embedded)
- [Apache OpenEJB admin service authentication bypass](https://junglewise.ai/threats/cve-2026-111251-the-admin-service-of-the-standalone-openejb-server-accepts-stop)