Apache security advisories, November 2026

Every Apache Software Foundation security advisory published in November 2026, from ASF Security ([email protected] CNA) via NVD, with its severity, CVEs and CISA KEV status. Open a record for affected and fixed versions and the vendor's own link.

Advisories: 184
Critical: 11
High: 64
In CISA KEV: 0

Apache advisories published in November 2026

Nov 10, 2026
High [CVE-2026-86336] Apache TomEE running on JDK 21 or later skips EJB method authorization checks, allowing callers to invoke EJB methods without the configured access restrictions being enforced
High
Nov 10, 2026
High [CVE-2026-111244] When MicroProfile JWT role-based access control is used, the access constraints of JAX-RS resources are not always enforced as declared: resources that declare an empty set of allowed roles are accessible to every caller, resource classes that inherit the same method from a common superclass share their constraints, and class-level constraints declared on a superclass are ignored
High
Nov 10, 2026
High [CVE-2026-111257] With the default configuration and no users defined in the default user database, TomEE silently adds an administrative user with a well-known password at startup
High
Nov 10, 2026
High [CVE-2026-111264] The security constraint generated for EJB JAX-WS endpoints with configured authentication protects only some HTTP methods
High
Nov 10, 2026
High [CVE-2026-111261] The Jakarta Security LDAP identity store accepts an empty password as valid if the directory server allows unauthenticated binds, which some directory servers do by default
High
Nov 10, 2026
Medium [CVE-2026-86531] The embedded OpenEJB HTTP server does not limit the size of incoming request bodies or of multipart requests, and does not remove the temporary files it creates for multipart parts
Medium
Nov 10, 2026
Medium [CVE-2026-87758] The remote EJB client does not verify that the hostname of the server it connects to matches the server's TLS certificate
Medium
Nov 10, 2026
Medium [CVE-2026-97849] The embedded Derby network service ignores its configured bind address and listens on all network interfaces
Medium
Nov 10, 2026
Medium [CVE-2026-97867] The EJBd remote protocol returns datasource connection details, including database credentials, to remote clients that look up a datasource
Medium
Nov 10, 2026
Medium [CVE-2026-97870] When Hessian remoting endpoints are served by the embedded HTTP server, configured authentication and transport security requirements are silently ignored
Medium
Nov 10, 2026
Medium [CVE-2026-97872] When an EJB is exposed over the optional Hessian protocol inside an existing web application, some configured authentication and transport security settings are silently not enforced
Medium
Nov 10, 2026
Medium [CVE-2026-97874] When Hessian remoting is configured with BASIC authentication, the authentication check is not applied to Hessian endpoints of applications deployed under a non-root context path
Medium
Nov 10, 2026
Medium [CVE-2026-97880] The embedded OpenEJB HTTP server dispatches some requests to REST endpoints configured for HTTP Basic authentication without verifying credentials
Medium
Nov 10, 2026
Medium [CVE-2026-97881] The embedded OpenEJB HTTP server does not restrict static resource paths to the configured resource directories
Medium
Nov 10, 2026
Medium [CVE-2026-97888] The embedded HTTP server does not clear the security identity established during a request before its worker thread handles the next request
Medium
Nov 10, 2026
Medium [CVE-2026-111239] The optional SSH administration service grants full access to the administration shell to every user that authenticates against its configured login domain, without checking for an administrative role
Medium
Nov 10, 2026
Medium [CVE-2026-111240] The JDBC based JAAS login module accepts a login without a password for accounts whose stored password is NULL
Medium
Nov 10, 2026
Medium [CVE-2026-111241] When a non-default stateful session bean passivation strategy is configured, passivated bean state is written to predictably named files in the shared system temporary directory, reusing files that already exist there, and is deserialized on activation
Medium
Nov 10, 2026
Medium [CVE-2026-111242] When MicroProfile JWT authentication is used for servlets that declare a run-as identity, the security state established for a request is not always cleared from the processing thread when the request does not complete normally
Medium
Nov 10, 2026
Medium [CVE-2026-111245] After a successful WS-Security UsernameToken authentication, the caller identity stays associated with the worker thread once the request completes when web services are served by the standalone OpenEJB HTTP server
Medium
Nov 10, 2026
Medium [CVE-2026-111247] When resolving security roles of a realm-authenticated caller, the caller's user name is also treated as a role name in addition to the roles assigned by the realm
Medium
Nov 10, 2026
Medium [CVE-2026-111250] The embedded OpenEJB HTTP server reports every request as authenticated when an application requests authentication programmatically
Medium
Nov 10, 2026
Medium [CVE-2026-111251] The admin service of the standalone OpenEJB server accepts stop requests without any authentication
Medium
Nov 10, 2026
Medium [CVE-2026-111256] When JAX-WS or JAX-RS endpoints are published by the embedded OpenEJB HTTP server rather than Tomcat, some configured authentication methods are silently ignored and the endpoint is published without authentication
Medium
Nov 10, 2026
Medium [CVE-2026-111258] The optional request routing feature forwards requests to their configured destination without applying the security constraints of that destination or the protection of the web application's private directories
Medium
Nov 10, 2026
Medium [CVE-2026-111259] The embedded server generates HTTP session identifiers with a non-cryptographic random number generator by default
Medium
Nov 10, 2026
Medium [CVE-2026-111263] Authentication configured for an EJB JAX-WS endpoint in the TomEE deployment descriptor is not enforced when the endpoint is published within an existing web application
Medium
Nov 10, 2026
Medium [CVE-2026-111262] The Jakarta Security LDAP identity store does not neutralize special characters in the caller name before using it in directory queries
Medium
Nov 10, 2026
Medium [CVE-2026-87756] The internal system EJBs used for remote deployment and configuration did not enforce their administrative role check when the server ran with the default profile
Medium
Nov 10, 2026
Medium [CVE-2026-87755] Stateful session bean identifiers are not generated from a cryptographically secure random source
Medium
Nov 10, 2026
Medium [CVE-2026-86811] The stateful session bean passivation mechanism derives the on-disk file name from a client-supplied identifier without validating it
Medium
Nov 10, 2026
Low [CVE-2026-97890] The embedded HTTP server does not invalidate the previous session identifier when an application changes the session id, e.g
Low
Nov 10, 2026
Low [CVE-2026-111243] negative MicroProfile JWT clock skew setting is not rejected and disables validation of the token expiration and other time-based claims
Low
Nov 10, 2026
Low [CVE-2026-111246] The embedded OpenEJB HTTP server does not isolate HTTP sessions between web applications
Low
Nov 10, 2026
Low [CVE-2026-111248] The Jakarta Security identity store backed by the Tomcat user database compares the supplied password with the stored value as plain text and ignores the configured credential handler
Low
Nov 10, 2026
Low [CVE-2026-111249] The development-time LiveReload support listens on all network interfaces without authentication and accepts websocket connections from any origin
Low
Nov 10, 2026
Low [CVE-2026-111260] The Jakarta Security OpenID Connect authentication mechanism generates the state and nonce values with a non-cryptographic random number generator and insufficient entropy
Low
Nov 10, 2026
Low [CVE-2026-86532] The bundled JAAS login modules leak whether a username exists and compare credentials in a non-constant-time manner
Low
Nov 9, 2026
Critical [CVE-2026-118196] OAuth 1 rebinding vulnerability in Apache Allura
Critical
Nov 9, 2026
High [CVE-2026-119078] Apache Commons Codec's Blake3 class documented the output of its doFinalize methods as depending on any previously finalized bytes, so that consecutive calls would return different output
High
Nov 9, 2026
High [CVE-2026-120367] Allocation of Resources Without Limits or Throttling vulnerability in Apache Axis2/Java
High7.5
Nov 9, 2026
High [CVE-2026-123753] Server-Side Request Forgery (SSRF) vulnerability in Apache Axis2/Java
High
Nov 9, 2026
High [CVE-2026-120761] Improper Restriction of XML External Entity Reference vulnerability in Apache Axis2/Java
High
Nov 9, 2026
High [CVE-2026-82436] Apache Storm: Description `DefaultStateSerializer`, used to persist and restore stateful bolt checkpoints, configured Kryo with class registration disabled and an instantiation strategy that constructs objects without invoking their constructors, then deserialized whatever bytes the state store returned
High
Nov 9, 2026
High [CVE-2026-68982] Apache Airflow's CeleryExecutor ran callback workloads (`ExecuteCallback`, used for deadline-alert callbacks) without validating the workload's authentication token
High
Nov 9, 2026
High [CVE-2026-76185] Apache Airflow's Task SDK secret cache built its keys from the team name and secret id with unescaped `_` delimiters, so different (team, secret id) pairs could collide
High
Nov 9, 2026
High [CVE-2026-86829] Apache Airflow's scheduler fully deserializes XCom values written by task code while evaluating task dependencies
High
Nov 9, 2026
High [CVE-2026-107474] Apache Airflow: Connections API: apprise connection "config" extra returned in cleartext
High
Nov 9, 2026
High [CVE-2026-111421] Apache Airflow's Task Execution API stored XCom values written by a task without the reserved-key check applied elsewhere, so a Dag author's task could write an XCom that, when a user later viewed it through the API with deserialization enabled, made the API server instantiate classes from the `airflow.*` namespace with arguments the Dag author chose
High8.8
Nov 9, 2026
Medium [CVE-2026-123766] Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) vulnerability in the OpenAPI module of Apache Axis2/Java
Medium
Nov 9, 2026
Medium [CVE-2026-120832] Server-Side Request Forgery (SSRF) vulnerability in Apache Axis2/Java
Medium
Nov 9, 2026
Medium [CVE-2026-82440] Nimbus instantiates the class named by a topology's `topology.scheduler.strategy` when scheduling it
Medium
Nov 9, 2026
Medium [CVE-2026-50204] Apache Airflow's audit log stored Connection and Variable secret values in cleartext in the `Log.extra` column because the secrets masker matched only on configured sensitive key names
Medium
Nov 9, 2026
Medium [CVE-2026-82337] Apache Airflow rebuilt deadline alert fields through generic deserialization, which imports and instantiates the class named in the serialized Dag, in the scheduler and API server
Medium
Nov 9, 2026
Medium [CVE-2026-96285] Apache Airflow 3.3.1 shipped a fix for CVE-2026-67260 that checks the scheduler's decoded `next_kwargs` value is a dictionary, but performs that check only after deserializing the whole stored payload
Medium
Nov 9, 2026
Medium [CVE-2026-113504] Apache Airflow's secrets masker stopped descending into nested structures after five levels, so a secret registered with the masker — for example a Connection password or a Variable value — that appeared more than five containers deep under non-sensitive keys was shown in cleartext in task logs and rendered template fields
Medium
Nov 9, 2026
Medium [CVE-2026-111395] Apache Airflow did not reject reserved serialization keys inside a Dag run's `conf`
Medium
Nov 9, 2026
Medium [CVE-2026-111453] Apache Airflow's API endpoint for deleting an asset's queued events checked Dag edit permission against the `dag_id` query parameter, but deleted the queued events of every Dag the caller could read
Medium4.3
Nov 9, 2026
Low [CVE-2026-124077] The GitIdentifiers class in Apache Commons Codec did not reject NUL bytes in tree entry names
Low
Nov 9, 2026
Low [CVE-2026-123779] Direct Request ('Forced Browsing') vulnerability in Apache Axis2/Java
Low
Nov 9, 2026
Low [CVE-2026-123770] Allocation of Resources Without Limits or Throttling vulnerability in Apache Axis2/Java
Low
Nov 9, 2026
Low [CVE-2026-40913] Apache Airflow's public Import Errors API returns the raw parse-failure stack trace to any user with the `ImportError.can_read` permission when the failing file has no registered DAG
Low
Nov 9, 2026
Low [CVE-2026-86468] Apache Airflow's CLI records its arguments in the audit log but masks secrets by argument position, so some supported command shapes leave secrets in cleartext, for example a trailing `--description` on Variable commands, `--conn-extra`, and the inline `--password` of `airflow keycloak-auth-manager` commands
Low
Nov 9, 2026
Low [CVE-2026-113508] Apache Airflow's logout endpoint attempted to revoke the presented token on the server, but any failure during revocation was silently ignored and logout still reported success
Low
Nov 9, 2026
Low [CVE-2026-101031] The `example_dag_decorator` example Dag shipped with Apache Airflow validated an IP address fetched over HTTP with Python's `ipaddress` module and then placed it into a shell command
Low
Nov 9, 2026
Low [CVE-2026-111452] Apache Airflow's secrets masker matched sensitive key names only in their snake_case form, so values stored under camelCase keys such as `privateKey`, `connectionString`, `webhookUrl` or `accessKey` — for example in a Connection's extra or a Variable — were not redacted in task logs, rendered template fields or API responses
Low
Nov 9, 2026
Low [CVE-2026-111454] Apache Airflow: API: asset endpoints return scheduled/producing/consuming Dag IDs the caller cannot read
Low
Nov 9, 2026
Low [CVE-2026-111455] Apache Airflow's asynchronous connection test checked permissions when the test was queued — only create permission when the connection ID did not exist yet — but, when the test completed with `commit_on_success`, wrote the tested connection under that ID
Low
Nov 6, 2026
High [CVE-2026-85111] Allocation of Resources Without Limits or Throttling in Apache James Mime4J library prior version 0.8.15 allows Denial of Service upon parsing Mime messages
High8.7
Nov 6, 2026
Advisory [CVE-2026-90436] ** UNSUPPORTED WHEN ASSIGNED ** Deserialization of an inbound SOAP fault in Apache Axis 1.x allows unauthenticated remote class instantiation
Unrated
Nov 6, 2026
Advisory [CVE-2026-85108] Allocation of Resources Without Limits or Throttling in Apache James Mime4J library prior version 0.8.15 allows Denial of Service upon parsing Mime messages
Unrated
Nov 6, 2026
Advisory [CVE-2026-76168] In Apache James server prior version 3.9.1 relying on the SieveFileRepository incorect validation of file paths can result in path transversal, allowing to set arbitrary SIEVE scripts for other users
Unrated
Nov 6, 2026
Advisory [CVE-2026-74756] Some docker-compose shipped by the project exposes by default Webadmin REST API publically without proper authentication setup
Unrated
Nov 6, 2026
Advisory [CVE-2026-76171] In Apache James server prior version 3.9.1 improper validation in JMAP webPush SSRF validation did lead to the possibility to reach internal addresses
Unrated
Nov 6, 2026
Advisory [CVE-2026-49939] In Apache James server prior version 3.9.1 improper Access Control List processing is exposed by the JMAP protocol which do not account for negative rules positionned by IMAP protocol
Unrated
Nov 6, 2026
Advisory [CVE-2025-66621] Apache James SASL OAuthBearer/XOAUTH2 prior versions 3.9.1 fails to validate correctly AUD claim of JWT payloads when introspection is not configured
Unrated
Nov 5, 2026
Critical [CVE-2026-82907] Authentication Bypass by Capture-replay in ExternalLoginKeysManager in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker who captures a live externalLoginKey value to obtain a complete, cookie-free, reusable session as the user who issued it, in every webapp that user can reach, because checkExternalLoginKey runs as a global preprocessor ahead of both the CSRF and authentication checks and accepts the key as a bearer credential that is never bound to a client, never expires, and is not invalidated after use, while the framework itself both appends live keys to every cross-webapp link it renders and, via WidgetWorker's unvalidated inter-app link target, lets an authenticated user's key be attached to an attacker-chosen absolute URL and delivered directly to the attacker's own server
Critical9.8
Nov 5, 2026
Critical [CVE-2026-83542] Improper Control of Generation of Code ('Code Injection') in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to execute arbitrary code on the server by staging crafted widget XML in a multipart upload and overriding the mainDecoratorLocation used by a manager login route through an anonymous JSON request, causing OFBiz to load the staged XML through its live screen descriptor mechanism and evaluate an unsandboxed Groovy expression while rendering the authentication-failure page
Critical9.8
Nov 5, 2026
Critical [CVE-2026-121489] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Juneau
Critical10.0
Nov 5, 2026
Critical [CVE-2026-96677] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Juneau
Critical10.0
Nov 5, 2026
Critical [CVE-2026-73117] Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability in Apache Juneau
Critical10.0
Nov 5, 2026
Critical [CVE-2026-73116] Insufficiently Protected Credentials vulnerability in Apache Juneau
Critical10.0
Nov 5, 2026
Critical [CVE-2026-73101] Generation of Error Message Containing Sensitive Information vulnerability in Apache Juneau
Critical10.0
Nov 5, 2026
Critical [CVE-2026-73100] Insertion of Sensitive Information into Log File vulnerability in Apache Juneau
Critical10.0
Nov 5, 2026
Critical [CVE-2026-73099] Cross-Site Request Forgery (CSRF) vulnerability in Apache Juneau
Critical10.0
Nov 5, 2026
Critical [CVE-2026-73098] Improper control of dynamically-loaded code vulnerability in Apache Juneau
Critical10.0
Nov 5, 2026
High [CVE-2026-71901] Improper Control of Resource Identifiers ('Resource Injection') vulnerability in Apache OFBiz
High8.1
Nov 5, 2026
High [CVE-2026-68524] Apache OFBiz: Pre-Authentication Remote Code Execution via Attacker-Controlled Screen Definition Loading
High
Nov 5, 2026
High [CVE-2026-73577] Apache OFBiz: Unauthenticated path-suffix view authorization bypass
High
Nov 5, 2026
High [CVE-2026-73578] Apache OFBiz: Unauthenticated saved-view authorization bypass with RCE impact
High
Nov 5, 2026
High [CVE-2026-74841] Apache OFBiz: Denial of Service via unauthenticated userTenantId in multitenant mode
High
Nov 5, 2026
High [CVE-2026-76150] Apache OFBiz: Authenticated path traversal and missing authorization check in replaceImageToExistImage
High
Nov 5, 2026
High [CVE-2026-81744] Apache OFBiz: Authorization bypass - self-grant content OWNER
High
Nov 5, 2026
High [CVE-2026-81815] Apache OFBiz: SQL injection - performFind ignore-case values, MySQL/MariaDB
High
Nov 5, 2026
High [CVE-2026-81828] Apache OFBiz: Server-side request forgery in SurveyWrapper
High
Nov 5, 2026
High [CVE-2026-82894] Apache OFBiz: Content renderer runs a service name stored on the row
High
Nov 5, 2026
High [CVE-2026-82904] Uncontrolled Resource Consumption in ServiceMultiEventHandler in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to pin a server request thread for an attacker-chosen number of synchronous service dispatches, up to the signed-integer maximum, by submitting a single small HTTP request whose parameter names encode a row count via the "o" suffix used by multi-form submissions, because UtilHttp.getMultiFormRowCount derives that count from the largest such suffix with no upper bound and ServiceMultiEventHandler.invoke then loops that many times calling dispatcher.runSync, with the request-map for getFinAccountTransRunningTotalAndBalances reaching this handler with no authentication or CSRF requirement on a stock deployment
High7.5
Nov 5, 2026
High [CVE-2026-82910] Improper Neutralization of Special Elements Used in a Template Engine ('Server-Side Template Injection') in MacroScreenRenderer in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the two view permissions of a control-servlet webapp (e.g
High8.8
Nov 5, 2026
High [CVE-2026-82912] Improper Neutralization of Special Elements Used in an Expression Language Statement ('Expression Language Injection') in EmailServices in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only OFBTOOLS_VIEW and ACCOUNTING_VIEW, the two view-level permissions that open the Accounting application, to execute arbitrary operating system commands as the account running OFBiz, by submitting a ${groovy:...} expression as the bodyText or subject value to the shipped Send Per Email invoice form, because sendMailFromScreen passes those caller-supplied values through FlexibleStringExpander.expandString, which compiles and evaluates embedded Groovy on a class loader that carries none of the SecureASTCustomizer restrictions GroovyUtil.eval applies elsewhere, behind a service and request-map that declare no permission check beyond base authentication
High8.8
Nov 5, 2026
High [CVE-2026-82916] Missing Authorization in XmlDsDump in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the webtools base permissions (OFBTOOLS_VIEW, WEBTOOLS_VIEW) — explicitly not the ENTITY_MAINT permission the export feature declares and visibly refuses to render for — to export the contents of any database entity, including UserLogin with its currentPassword hashes, to any filesystem path the OFBiz process can write, including a web-served docroot, and to create arbitrary directories or truncate arbitrary existing files at those paths, because the XmlDsDump screen action writes the requested entity data via new FileOutputStream on unvalidated outpath and filename request parameters before the screen's ENTITY_MAINT permission check runs, unlike the equivalent Java service entityExportAll, which enforces both a permission check and a file-path allow-list
High7.1

Page 1 of 2 · 100 of 184

Get an email when Apache publishes the next one.

See Apache's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).

Alert me about Apache

Dates are each advisory's publication date at the source, in UTC; a record with no source date is filed under the day VulniPulse first saw it.