Incorrect Default Permissions in Apache ActiveMQ Affects Security Management

CVE-2026-49157

What is CVE-2026-49157?

The vulnerability in Apache ActiveMQ arises from incorrect default permissions within its Jolokia authorization settings. This flaw enables low-privilege web-login accounts to perform administrative actions, such as adding or removing queues that should be restricted to higher privilege users. Affected users are strongly encouraged to upgrade to the latest versions (5.19.7 or 6.2.6) to mitigate this risk and enhance their security posture.

References