CVE-2026-49434: Apache ActiveMQ Improper Input Validation in LDAP integration

CVE-2026-49434 · Severity: high · CVSS 7.5 · Published 2026-06-30

Apache ActiveMQ is a popular open-source message broker used to facilitate communication between different software applications. A vulnerability exists where an attacker with the ability to modify directory service (LDAP) entries can force the message broker to connect to a malicious server. This could allow the attacker to run unauthorized services within the broker's environment, potentially leading to a complete compromise of the messaging infrastructure and the data it handles.

Technologies: org.apache.activemq:activemq-all (Maven), org.apache.activemq:activemq-broker (Maven), org.apache.activemq:apache-activemq (Maven). Vendors: Maven.

Quick answers

Is CVE-2026-49434 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-49434 being exploited in the wild.
How severe is CVE-2026-49434?
High severity, with a CVSS score of 7.5, published 30 June 2026.
Which products and versions are affected?
org.apache.activemq:activemq-all (Maven) < 5.19.8, ECOSYSTEM:introduced=0,fixed=5.19.8; org.apache.activemq:activemq-broker (Maven) < 5.19.8, ECOSYSTEM:introduced=0,fixed=5.19.8; org.apache.activemq:apache-activemq (Maven) < 5.19.8, ECOSYSTEM:introduced=0,fixed=5.19.8.
Is there a fix for CVE-2026-49434?
Yes. org.apache.activemq:activemq-all (Maven): upgrade to 5.19.8 or later; org.apache.activemq:activemq-broker (Maven): upgrade to 5.19.8 or later; org.apache.activemq:apache-activemq (Maven): upgrade to 5.19.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-49434 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-49434?
Check whether you run org.apache.activemq:activemq-all (Maven), org.apache.activemq:activemq-broker (Maven) or org.apache.activemq:apache-activemq (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.apache.activemq:activemq-all (Maven): upgrade to 5.19.8 or later
    # set org.apache.activemq:activemq-all to 5.19.8 in your pom.xml or build.gradle
  • org.apache.activemq:activemq-broker (Maven): upgrade to 5.19.8 or later
    # set org.apache.activemq:activemq-broker to 5.19.8 in your pom.xml or build.gradle
  • org.apache.activemq:apache-activemq (Maven): upgrade to 5.19.8 or later
    # set org.apache.activemq:apache-activemq to 5.19.8 in your pom.xml or build.gradle

Technical details

An improper input validation vulnerability (CWE-20) exists in Apache ActiveMQ's LDAP integration. An attacker who can publish or modify LDAP entries matching the configured 'searchBase' and 'searchFilter' can bypass transport restrictions. By manipulating these entries, the attacker can force the broker JVM to fetch a remote URL and instantiate a second 'BrokerService' instance. This effectively allows for remote code execution or unauthorized service persistence within the same Java Virtual Machine. The issue is resolved in versions 5.19.8 and 6.2.7.

Affected products

  • Apache Software Foundation Apache ActiveMQ Broker before 5.19.8, 6.0.0 to 6.2.6
  • Apache Software Foundation Apache ActiveMQ before 5.19.8, 6.0.0 to 6.2.6
  • Apache Software Foundation Apache ActiveMQ All before 5.19.8, 6.0.0 to 6.2.6

Identifiers

  • CVE-2026-49434
  • BIT-ACTIVEMQ-2026-49434
  • GHSA-h5gm-rvw6-2xpx

Timeline

  • 2026-06-30: disclosed
  • 2026-06-30: advisory
  • 2026-06-30: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.