CVSS 3.1
8.8 highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVE-2026-49157
High (8.8) in apache activemq. EPSS 0.4% chance of exploitation in the next 30 days. Fixed in org.apache.activemq:apache-activemq 5.19.7, 6.2.6.
Incorrect Default Permissions vulnerability in Apache ActiveMQ.
This issue affects Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6.
The default Jolokia authorization settings granted non-admin (low-privilege) web-login accounts access to Jolokia operations which allowed executing broker management operations meant for admins such as addQueue and removeQueue.
Users are recommended to upgrade to version 6.2.6 or 5.19.7, which fixes the issue.
Severity
- EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 38% of CVEs (scores of 2026-10-31)
- CWE
- CWE-276
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:activemq
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-99qx-5qqr-4j95 | Maven | org.apache.activemq:apache-activemq | <5.19.7 | 5.19.7 |
| GHSA-99qx-5qqr-4j95 | Maven | org.apache.activemq:apache-activemq | >=6.0.0 <6.2.6 | 6.2.6 |