Executive brief
Apache ActiveMQ, a widely used message broker for enterprise data exchange, contains a security flaw where default settings allow users with low-level access to perform administrative tasks. An attacker with basic login credentials could manipulate the message broker by adding or deleting message queues, potentially disrupting business operations or intercepting data. This issue is resolved by updating to the latest patched versions.
Technical details
An incorrect default permissions vulnerability (CWE-276) exists in Apache ActiveMQ's Jolokia configuration. The default authorization settings fail to restrict administrative Jolokia operations to admin-level accounts, allowing any authenticated low-privilege web user to execute broker management commands. Specifically, an attacker can perform actions such as 'addQueue' and 'removeQueue' which are intended for administrators. This vulnerability is reachable over the network via the web management interface. The issue is addressed in versions 5.19.7 and 6.2.6 by correcting the default Jolokia authorization policies.
Affected products
- Apache ActiveMQ < 5.19.7, 6.0.0 to < 6.2.6
Timeline
- 2026-05-31: disclosed: Initial disclosure on oss-security mailing list
- 2026-06-01: advisory: GitHub and NVD advisories published