CVE-2026-49157: Apache ActiveMQ incorrect default permissions in Jolokia

CVE-2026-49157 · Severity: high · CVSS 8.8 · Published 2026-06-01

Apache ActiveMQ, a widely used message broker for enterprise data exchange, contains a security flaw where default settings allow users with low-level access to perform administrative tasks. An attacker with basic login credentials could manipulate the message broker by adding or deleting message queues, potentially disrupting business operations or intercepting data. This issue is resolved by updating to the latest patched versions.

Technologies: Apache ActiveMQ, org.apache.activemq:apache-activemq (Maven). Vendors: Apache, Maven.

Quick answers

Is CVE-2026-49157 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-49157 being exploited in the wild.
How severe is CVE-2026-49157?
High severity, with a CVSS score of 8.8, published 1 June 2026.
Which products and versions are affected?
Apache ActiveMQ < 5.19.7, 6.0.0 to < 6.2.6; org.apache.activemq:apache-activemq (Maven) ECOSYSTEM:introduced=0,fixed=5.19.7.
Is there a fix for CVE-2026-49157?
Yes. org.apache.activemq:apache-activemq (Maven): upgrade to 5.19.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-49157 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-49157?
Check whether you run Apache ActiveMQ or org.apache.activemq:apache-activemq (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.apache.activemq:apache-activemq (Maven): upgrade to 5.19.7 or later
    # set org.apache.activemq:apache-activemq to 5.19.7 in your pom.xml or build.gradle

Technical details

An incorrect default permissions vulnerability (CWE-276) exists in Apache ActiveMQ's Jolokia configuration. The default authorization settings fail to restrict administrative Jolokia operations to admin-level accounts, allowing any authenticated low-privilege web user to execute broker management commands. Specifically, an attacker can perform actions such as 'addQueue' and 'removeQueue' which are intended for administrators. This vulnerability is reachable over the network via the web management interface. The issue is addressed in versions 5.19.7 and 6.2.6 by correcting the default Jolokia authorization policies.

Affected products

  • Apache ActiveMQ < 5.19.7, 6.0.0 to < 6.2.6

Identifiers

  • CVE-2026-49157
  • GHSA-99qx-5qqr-4j95

Timeline

  • 2026-05-31: disclosed: Initial disclosure on oss-security mailing list
  • 2026-06-01: advisory: GitHub and NVD advisories published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.