CVE-2026-49157CWE-276

Apache ActiveMQ: Authenticated low-privilege Web users retain Jolokia broker-management capability by default

High · published June 1, 2026

CVSS v3.1
8.8
EPSS
1%
Percentile
49.4
In the wild
Unconfirmed
What it is

Incorrect Default Permissions vulnerability in Apache ActiveMQ.

This issue affects Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6.

The default Jolokia authorization settings granted non-admin (low-privilege) web-login accounts access to Jolokia operations which allowed executing broker management operations meant for admins such as addQueue and removeQueue.

Users are recommended to upgrade to version 6.2.6 or 5.19.7, which fixes the issue.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00626 · 49.4th percentile
Weakness
CWE-276 · Incorrect Default Permissions
Published
2026-06-01T07:20Z
EPSS history
Timeline
  • 01 JUN 07:20Z
    Apache ActiveMQ: Authenticated low-privilege Web users retain Jolokia broker-management capability by default
    cvelistv5