CVE-2026-49157
Fixed upstream EPSS <1%CVSS 8.8
Incorrect Default Permissions vulnerability in Apache ActiveMQ. This issue affects Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6. The default Jolokia authorization settings granted non-admin (low-privilege) web-login accounts access to Jolokia operations which allowed executing broker management operations meant for admins such as addQueue and removeQueue. Users are recommended to upgrade to version 6.2.6 or 5.19.7, which fixes the issue.
Products: Apache Software Foundation Apache ActiveMQ
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.apache.activemq:apache-activemq | 5.19.7 |
| Maven | org.apache.activemq:apache-activemq | 6.2.6 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | activemq | no fix |
| Debian 13 | activemq | no fix |
| Ubuntu 24.04 LTS | activemq | no fix |
| Ubuntu 25.10 | activemq | no fix |
| Ubuntu 26.04 LTS | activemq | no fix |
| Ubuntu 26.10 | activemq | no fix |
| Ubuntu Pro 16.04 LTS | activemq | no fix |
| Ubuntu Pro 18.04 LTS | activemq | no fix |
| Ubuntu Pro 20.04 LTS | activemq | no fix |
| Ubuntu Pro 22.04 LTS | activemq | no fix |