PT-2026-45381 · Apache · Apache Activemq+1

Leon Johnson · Published 2026-06-01 · Updated 2026-06-02 · CVE-2026-49157

Mitre

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Incorrect Default Permissions vulnerability in Apache ActiveMQ.

This issue affects Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6.

The default Jolokia authorization settings granted non-admin (low-privilege) web-login accounts access to Jolokia operations which allowed executing broker management operations meant for admins such as addQueue and removeQueue.

Users are recommended to upgrade to version 6.2.6 or 5.19.7, which fixes the issue.

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2026-49157

Affected Products

Apache Activemq

Activemq

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-49157 · Security Note
• https://lists.apache.org/thread/rrcsf6s90hj4tdh89nvkko75q5505rj8 · Vendor Advisory
• http://openwall.com/lists/oss-security/2026/05/31/21 · Note
• https://twitter.com/CCBalert/status/2061805141255160107 · Twitter Post