CVE-2026-49157: Apache ActiveMQ Incorrect Default Permissions Vulnerability
Summary
CVE-2026-49157: Apache ActiveMQ has an Incorrect Default Permissions vulnerability. Affects org.apache.activemq:apache-activemq across 2 version ranges.
< 5.19.7
>= 6.0.0, < 6.2.6
Fixed in 5.19.7 or 6.2.6, depending on the release line you run. How to fix ↓
Also tracked for
- activemq · Bitnami
The same CVE-2026-49157 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache ActiveMQ is an open-source message broker that facilitates communication between applications by sending messages between them. It supports various messaging protocols and is widely used in enterprise applications for its reliability and scalability. However, prior to versions 5.19.7 and 6.2.6, ActiveMQ had a vulnerability related to incorrect default permissions that could allow low-privilege users to perform administrative actions.
Vulnerability Detail
The vulnerability stems from incorrect default permissions in Apache ActiveMQ's Jolokia authorization settings. This misconfiguration allows non-admin web-login accounts to access Jolokia operations that should be restricted to administrators. As a result, these low-privilege users can execute critical broker management operations, such as adding or removing queues, which could lead to unauthorized access and manipulation of messaging resources.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 5.19.75.19.7 -
>= 6.0.0, < 6.2.66.2.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can restrict access to Jolokia operations by modifying the authorization settings in their ActiveMQ configuration. However, this is not a substitute for upgrading to the fixed versions.
Conclusion
The Incorrect Default Permissions vulnerability in Apache ActiveMQ poses a significant risk by allowing low-privilege users to perform administrative actions. Users are strongly advised to upgrade to the latest patched versions to mitigate this risk. Additionally, temporary workarounds can be implemented until the upgrade is complete.
See every vulnerability recorded for org.apache.activemq:apache-activemq →
FAQ
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
The affected versions are Apache ActiveMQ before 5.19.7 and from 6.0.0 before 6.2.6.
Low-privilege users can perform administrative operations such as adding and removing queues, which should be restricted to admin users.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application using the Vulert playground without any signup at Vulert Scanner.
If immediate upgrading is not possible, ensure to restrict access to Jolokia operations as a temporary workaround until you can apply the necessary updates.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.activemq:apache-activemq.
