Threats affecting pkg:maven/org.apache.openejb/openejb-ssh

CVE-2026-111239 is a missing authorization vulnerability in Apache TomEE's optional SSH administration service. The service grants full administrative shell access to any user authenticated in its configured login domain without verifying administrative privileges. This allows attackers with any user credentials in that domain, including low-privileged users, to execute arbitrary code as the server process. Users are advised to disable the SSH administration service or restrict its access to trusted administrative users only.