GHSA-99qx-5qqr-4j95 BIT-activemq-2026-49157 CVE-2026-49157
Apache ActiveMQ has an Incorrect Default Permissions vulnerability
- Severity
- 8.8 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 0.44%
- Chance of exploitation in the next 30 days. Higher than 38.23% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-276 Incorrect Default Permissions
- Fix
5.19.7- Upgrade org.apache.activemq:apache-activemq to this version or later
Description
Incorrect Default Permissions vulnerability in Apache ActiveMQ.
This issue affects Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6.
The default Jolokia authorization settings granted non-admin (low-privilege) web-login accounts access to Jolokia operations which allowed executing broker management operations meant for admins such as addQueue and removeQueue.
Users are recommended to upgrade to version 6.2.6 or 5.19.7, which fixes the issue.
Affected versions
Maven
| Package | Vulnerable | Fixed in |
|---|---|---|
| org.apache.activemq:apache-activemq | < 5.19.7 |
5.19.7 |
| org.apache.activemq:apache-activemq | >= 6.0.0, < 6.2.6 |
6.2.6 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
org.apache.activemq:apache-activemq Maven → 5.19.7
- maven
<dependency><groupId>org.apache.activemq</groupId><artifactId>apache-activemq</artifactId><version>5.19.7</version></dependency>- gradle
implementation("org.apache.activemq:apache-activemq:5.19.7")
Severity breakdown
CVSS 3.1 8.8
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weakness
CWE-276: Incorrect Default Permissions
During installation, installed file permissions are set to allow anyone to modify those files.
How to prevent it
- Architecture and Design, Operation: The architecture needs to access and modification attributes for files to only those users who actually require those actions.
- Architecture and Design: Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-hf52-78x8-6w3w Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All have an Exposure of Sensitive Information Through Metadata vulnerability | Medium | Also affects org.apache.activemq:apache-activemq |
| GHSA-cpw7-g3p5-qrfq Apache ActiveMQ server has an incomplete authorization workflow | Medium | Also affects org.apache.activemq:apache-activemq |
| GHSA-v853-w46p-fv2h Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ have a Code Injection issue | High | Also affects org.apache.activemq:apache-activemq |
| GHSA-hg6c-8mvr-jqc9 Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ have a Code Injection issue | High | Also affects org.apache.activemq:apache-activemq |
| GHSA-8wm6-6fqh-phmc Apache ActiveMQ, Apache ActiveMQ Web have a Cross-site Scripting issue | Medium | Also affects org.apache.activemq:apache-activemq |
| GHSA-mr6m-xj7v-3cv3 Apache ActiveMQ Vulnerable to Code Injection | High | Also affects org.apache.activemq:apache-activemq |
| GHSA-2jp3-2923-9h52 Apache ActiveMQ Vulnerable to Cross-site Scripting | Medium | Also affects org.apache.activemq:apache-activemq |
| GHSA-w3w2-mpp5-92gm Apache ActiveMQ Vulnerable to Improper Input Validation and Code Injection | High | Also affects org.apache.activemq:apache-activemq |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor