Incorrect Default Permissions vulnerability in Apache ActiveMQ. (CVE-2026-49157)
Description
Apache ActiveMQ versions before 5.19.7 and from 6.0.0 before 6.2.6 have an incorrect default permissions vulnerability. The default Jolokia authorization settings allowed low-privilege web-login accounts to perform broker management operations intended only for administrators, such as adding or removing queues. This could lead to unauthorized management actions on the message broker. Upgrading to versions 5.19.7 or 6.2.6 or later resolves this issue.
CVSS v3.1
Score 8.8high
Affected software
pkg:deb/ubuntu/activemq?arch=source&distro=esm-apps/xenialpkg:deb/ubuntu/activemq?arch=source&distro=esm-apps/bionicpkg:deb/ubuntu/activemq?arch=source&distro=esm-apps/focalpkg:deb/ubuntu/activemq?arch=source&distro=esm-apps/jammypkg:deb/ubuntu/activemq?arch=source&distro=noblepkg:deb/ubuntu/activemq?arch=source&distro=questingpkg:deb/ubuntu/activemq?arch=source&distro=stonkingpkg:deb/ubuntu/activemq?arch=source&distro=resoluteRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-49157 describes an incorrect default permissions vulnerability in Apache ActiveMQ affecting versions before 5.19.7 and from 6.0.0 before 6.2.6. The vulnerability arises because the default Jolokia authorization settings grant non-admin, low-privilege web-login users access to Jolokia operations that allow execution of broker management functions like addQueue and removeQueue. This misconfiguration enables unauthorized users to perform administrative operations on the broker. The issue is fixed in Apache ActiveMQ versions 5.19.7 and 6.2.6.
Potential Impact
Unauthorized users with low-privilege web-login accounts can execute broker management operations intended for administrators, potentially allowing them to add or remove queues and disrupt message broker functionality. The CVSS score of 8.8 indicates a high severity impact on confidentiality, integrity, and availability.
Mitigation Recommendations
Upgrade Apache ActiveMQ to version 5.19.7 or 6.2.6 or later, where the Jolokia authorization settings have been corrected to restrict management operations to admin users only. No other mitigation is indicated by the vendor advisory.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2026-49157
- Osv Schema Version
- 1.7.0
- Ecosystems
- ["Ubuntu:Pro:16.04:LTS","Ubuntu:Pro:18.04:LTS","Ubuntu:Pro:20.04:LTS","Ubuntu:Pro:22.04:LTS","Ubuntu:24.04:LTS","Ubuntu:25.10","Ubuntu:26.10","Ubuntu:26.04:LTS"]
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ad3f61b2cdf04f65666418e
Added to database: 10/17/2026, 22:26:35 UTC
Last enriched: 10/18/2026, 01:04:33 UTC
Last updated: 10/18/2026, 01:04:33 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.