CVE-2026-49157: Apache ActiveMQ - Authenticated Low-Privilege Web Users Retain Jolokia Broker-Management Capability
Summary
CVE-2026-49157: Incorrect Default Permissions vulnerability in Apache ActiveMQ. Affects activemq across 2 version ranges.
< 5.19.7
>= 6.0.0, < 6.2.6
Fixed in 5.19.7 or 6.2.6, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2026-49157 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache ActiveMQ is an open-source message broker that facilitates communication between different applications by sending messages between them. It supports various messaging protocols and is widely used for its reliability and scalability. However, certain versions of ActiveMQ have a vulnerability that allows low-privilege web users to access broker management operations, which should be restricted to admin users only.
Vulnerability Detail
The vulnerability arises from incorrect default permissions in Apache ActiveMQ, specifically affecting versions before 5.19.7 and from 6.0.0 to before 6.2.6. Non-admin web-login accounts are granted access to Jolokia operations, enabling them to perform sensitive broker management tasks such as adding or removing queues. This could lead to unauthorized changes in the messaging infrastructure, potentially compromising the integrity and availability of the messaging system.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 5.19.75.19.7 -
>= 6.0.0, < 6.2.66.2.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can restrict access to Jolokia operations by modifying the authorization settings in the ActiveMQ configuration file. This can be done by explicitly denying access to non-admin users until the upgrade is performed.
Conclusion
In summary, CVE-2026-49157 poses a significant risk to Apache ActiveMQ users by allowing low-privilege accounts to perform sensitive operations. It is crucial to upgrade to the latest patched versions to mitigate this vulnerability and ensure the security of your messaging system.
See every vulnerability recorded for activemq →
FAQ
CVE-2026-49157 is a vulnerability in Apache ActiveMQ that allows low-privilege web users to perform broker management operations due to incorrect default permissions.
The vulnerability affects Apache ActiveMQ versions before 5.19.7 and from 6.0.0 to before 6.2.6.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected by this vulnerability without any signup.
The risks include unauthorized access to broker management operations, which could lead to data loss, service disruption, or unauthorized changes in the messaging infrastructure.
If an immediate upgrade is not possible, consider implementing stricter access controls in your ActiveMQ configuration to limit Jolokia access for non-admin users.
Related vulnerabilities
Recent vulnerabilities recorded for activemq.
