CVE-2026-111244: MicroProfile JWT: RBAC bypass on JAX-RS resources

AWAITING NVD

Published November 10, 2026

CISO Take

A flaw in MicroProfile JWT role-based access control means JAX-RS endpoints may not enforce their declared role restrictions: resources with an empty allowed-roles set become open to every caller, inherited methods share constraints, and superclass-level constraints are ignored. A remote attacker can reach endpoints that should be denied, in some configurations without authentication. There is no CVSS, EPSS or KEV data yet, no public exploit and no Nuclei template, so urgency is driven by exposure rather than observed exploitation. The package is not one we track as an AI component and no affected products are listed, so check whether any Java services in your AI/ML stack (model-serving gateways, inference APIs, internal ML platform backends) use MicroProfile JWT. Upgrade to 10.3.0 or 11.0.0-M2 and audit endpoints that rely on empty role sets or inherited access constraints.

Sources:NVDATLASlists.apache.org

What is the risk?

Severity is not yet scored. The weakness is CWE-863 (Incorrect Authorization), exploitable remotely, and in some configurations without authentication, so real-world risk can be high for exposed APIs. Exploitation needs no AI-specific knowledge, but it depends on a specific access-control pattern (empty roles, inherited methods, superclass constraints). There is no known exploitation, no public PoC and no EPSS data. The AI/ML link is indirect: it matters only where Java JAX-RS services front AI workloads.

How does the attack unfold?

Initial Access

Attacker discovers a network-reachable JAX-RS endpoint protected by MicroProfile JWT RBAC.

AML.T0049

Exploitation

Attacker calls a resource with an empty roles set or an inherited method whose constraints are not enforced, bypassing authorization.

AML.T0049

Impact

Attacker accesses restricted AI/ML platform functions or data without proper privileges.

Initial Access

Attacker discovers a network-reachable JAX-RS endpoint protected by MicroProfile JWT RBAC.

AML.T0049

Exploitation

Attacker calls a resource with an empty roles set or an inherited method whose constraints are not enforced, bypassing authorization.

AML.T0049

Impact

Attacker accesses restricted AI/ML platform functions or data without proper privileges.

How severe is it?

CVSS 3.1

N/A

EPSS

0.2%

chance of exploitation in 30 days

Higher than 12% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What should I do?

1 step

1) Upgrade to version 10.3.0 or 11.0.0-M2. 2) Inventory JAX-RS resources that use role-based annotations, especially empty role sets, shared superclass methods and class-level constraints on superclasses. 3) As a workaround, declare constraints explicitly on each concrete resource class and method, and avoid relying on inheritance or empty role sets. 4) Add a network-level control (API gateway, mTLS or IP allowlist) in front of sensitive endpoints. 5) Test access control by calling protected endpoints without a token and with low-privilege tokens, and review access logs for unexpected successful calls to restricted resources.

How is it classified?

Auth BypassFrameworkAPIAML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Respond to and manage risks from AI system components

Frequently Asked Questions

What is CVE-2026-111244?

Is CVE-2026-111244 actively exploited?

No confirmed active exploitation of CVE-2026-111244 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-111244?

1) Upgrade to version 10.3.0 or 11.0.0-M2. 2) Inventory JAX-RS resources that use role-based annotations, especially empty role sets, shared superclass methods and class-level constraints on superclasses. 3) As a workaround, declare constraints explicitly on each concrete resource class and method, and avoid relying on inheritance or empty role sets. 4) Add a network-level control (API gateway, mTLS or IP allowlist) in front of sensitive endpoints. 5) Test access control by calling protected endpoints without a token and with low-privilege tokens, and review access logs for unexpected successful calls to restricted resources.

What systems are affected by CVE-2026-111244?

This vulnerability affects the following AI/ML architecture patterns: Model serving, ML platform APIs, Java-based AI backends, API gateways.

What is the CVSS score for CVE-2026-111244?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

Model servingML platform APIsJava-based AI backendsAPI gateways

MITRE ATLAS Techniques

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

What are the technical details?

Original Advisory

When MicroProfile JWT role-based access control is used, the access constraints of JAX-RS resources are not always enforced as declared: resources that declare an empty set of allowed roles are accessible to every caller, resource classes that inherit the same method from a common superclass share their constraints, and class-level constraints declared on a superclass are ignored. A remote attacker can invoke resources that should be denied to them, in some configurations without authentication. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.

Exploitation Scenario

An attacker finds an internet-exposed Java service that fronts an internal ML platform, for example a model registry or inference management API secured with MicroProfile JWT. They send requests to administrative endpoints that should be restricted. Because the endpoint declares an empty role set, or inherits its method from a superclass whose constraints are mishandled, the server accepts the request without proper authorization. The attacker then lists or downloads models, changes deployment settings or triggers expensive inference jobs.

Weaknesses (CWE)

CWE-863Incorrect AuthorizationPrimary CWE-863Incorrect Authorization

CWE-863 — Incorrect Authorization: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.