GitHub Advisoryadvisory · Maven

GHSA-99qx-5qqr-4j95 Apache ActiveMQ has an Incorrect Default Permissions vulnerability

HIGH Published 2026-06-01 Modified 2026-07-09 Official page ↗
Aliases
CVE-2026-49157
Ecosystem
Maven
Packages
org.apache.activemq:apache-activemq
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-276
Reviewed
2026-07-09

Affected packages

• Maven org.apache.activemq:apache-activemq: < 5.19.7 → fixed in 5.19.7 • Maven org.apache.activemq:apache-activemq: >= 6.0.0, < 6.2.6 → fixed in 6.2.6

Description

Incorrect Default Permissions vulnerability in Apache ActiveMQ. This issue affects Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6. The default Jolokia authorization settings granted non-admin (low-privilege) web-login accounts access to Jolokia operations which allowed executing broker management operations meant for admins such as addQueue and removeQueue. Users are recommended to upgrade to version 6.2.6 or 5.19.7, which fixes the issue.

Related

Alias · CVE (1)

  • CVE-2026-49157 Incorrect Default Permissions vulnerability in Apache ActiveMQ. vulnerability

Weakness · CWE (1)

  • CWE-276 Incorrect Default Permissions weakness

References