Information Exposure Flaw in Apache ActiveMQ Products

CVE-2026-49270

What is CVE-2026-49270?

A vulnerability exists in Apache ActiveMQ products where brokers configured with a network connector having syncDurableSubs set to true can be exploited by unauthenticated attackers. By sending a BrokerInfo command, attackers may gain unauthorized access to sensitive data such as durable topic subscriptions, client identifiers, subscription names, topic destinations, and JMS selector expressions. This issue arises because the broker fails to authenticate the connection before responding. Users are urged to upgrade their systems to version 6.2.6 or 5.19.7 to mitigate this exposure.

References