PT-2026-45383 · Apache · Activemq

Basel Khaled · Published 2026-06-01 · Updated 2026-06-01 · CVE-2026-49270

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache ActiveMQ Broker versions prior to 5.19.7 Apache ActiveMQ Broker versions 6.0.0 through 6.2.5 Apache ActiveMQ versions prior to 5.19.7 Apache ActiveMQ versions 6.0.0 through 6.2.5 Apache ActiveMQ All versions prior to 5.19.7 Apache ActiveMQ All versions 6.0.0 through 6.2.5

Description An exposure of sensitive information through metadata occurs when brokers are configured with a network connector where syncDurableSubs is set to true. An unauthenticated attacker can retrieve a list of all durable topic subscriptions in the broker by sending a BrokerInfo command. The broker fails to ensure the connection is authenticated before responding, potentially leaking client identifiers, subscription names, topic destinations, and JMS selector expressions.

Recommendations Upgrade to version 5.19.7 Upgrade to version 6.2.6

Fix

Weakness Enumeration

CWE-1230

Related Identifiers

CVE-2026-49270

Affected Products

Activemq

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-49270 · Security Note
• https://lists.apache.org/thread/k3233c1x506z3w7x4z0dqvd86d4v2fr2 · Vendor Advisory
• http://openwall.com/lists/oss-security/2026/05/31/22 · Note
• https://t.me/CVEtracker/55465 · Telegram Post