- Description
- Incorrect Default Permissions vulnerability in Apache ActiveMQ. This issue affects Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6. The default Jolokia authorization settings granted non-admin (low-privilege) web-login accounts access to Jolokia operations which allowed executing broker management operations meant for admins such as addQueue and removeQueue. Users are recommended to upgrade to version 6.2.6 or 5.19.7, which fixes the issue.
- Source
- security@apache.org
- NVD status
- Analyzed
- Products
- activemq
CVSS 3.1
- Type
- Secondary
- Base score
- 8.8
- Impact score
- 5.9
- Exploitability score
- 2.8
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Severity
- HIGH
- security@apache.org
- CWE-276
- Hype score
- Not currently trending
Warning: #Apache patched 3 vulnerabilities in Apache #ActiveMQ. CVE-2026-45505; CVSS:8.0, CVE-2026-49157; CVSS:8.8 & CVE-2026-42588; CVSS:8.1 may lead to high confidentiality, integrity and availability impact in affected versions. Time to #Patch #Patch #Patch
@CCBalert
2 Jun 2026
152 Impressions
1 Retweet
0 Likes
0 Bookmarks
0 Replies
0 Quotes
CVE-2026-49157 CVE-2026-49157 https://t.co/rYyjqy77tL
@VulmonFeeds
31 May 2026
51 Impressions
1 Retweet
0 Likes
0 Bookmarks
0 Replies
0 Quotes
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*",
"matchCriteriaId": "793E68E6-9024-4518-B062-42B2DE5BB555",
"versionEndExcluding": "5.19.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*",
"matchCriteriaId": "FFF44DB9-1850-4B5F-AD0F-55CB5219AB22",
"versionEndExcluding": "6.2.6",
"versionStartIncluding": "6.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
]