CVE-2026-49157: Apache ActiveMQ has an Incorrect Default Permissions vulnerability

June 1, 2026 (updated July 9, 2026)

Incorrect Default Permissions vulnerability in Apache ActiveMQ.

This issue affects Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6.

The default Jolokia authorization settings granted non-admin (low-privilege) web-login accounts access to Jolokia operations which allowed executing broker management operations meant for admins such as addQueue and removeQueue.

Users are recommended to upgrade to version 6.2.6 or 5.19.7, which fixes the issue.

References

github.com/advisories/GHSA-99qx-5qqr-4j95
lists.apache.org/thread/rrcsf6s90hj4tdh89nvkko75q5505rj8
nvd.nist.gov/vuln/detail/CVE-2026-49157

Code Behaviors & Features

Detect and mitigate CVE-2026-49157 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →