This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Apache ActiveMQ fixes 2 vulnerabilities
The Apache Software Foundation fixes 2 vulnerabilities in Apache ActiveMQ products (Classic, All, Broker) with versions 5.19.7 and 6.2.6 [1][2].
An authenticated remote attacker with low privileges can, due to incorrect default permission settings in Jolokia authorization, perform broker administration operations such as addQueue and removeQueue [1].
The vulnerability is present in product:
- Apache ActiveMQ; <5.19.7; >=6.0.0, <6.2.6
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2026-49157 at cve.org, NVD
- CWE-276: Incorrect Default Permissions at cwe.mitre.org
The vulnerability was publicly disclosed 31. 5. 2026.
An unauthenticated remote attacker can, due to a missing authentication check when processing the BrokerInfo command, obtain a list of durable topic subscriptions, including client identifiers, subscription names, target topics and JMS selectors [2].
The vulnerability is present in products:
- Apache ActiveMQ; >=5.14.0, <5.19.7; >=6.0.0, <6.2.6
- Apache ActiveMQ All; >=5.14.0, <5.19.7; >=6.0.0, <6.2.6
- Apache ActiveMQ Broker; >=5.14.0, <5.19.7; >=6.0.0, <6.2.6
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
More information:
- CVE-2026-49270 at cve.org, NVD
- CWE-1230: Exposure of Sensitive Information Through Metadata at cwe.mitre.org
The vulnerability was publicly disclosed 31. 5. 2026.
Links
By CESNET, z.s.p.o. Michaela Jarošová on 2. 6. 2026.