ORG.APACHE.ACTIVEMQ:ACTIVEMQ-BROKER · CVE-2026-49434 · Package
FIX → 5.19.8 · 6.2.7
Apache ActiveMQ lets an attacker who can publish or modify entries in the LDAP directory used by the broker instantiate denied transports inside the broker JVM. This can make the broker fetch an attacker-controlled URL and start a second BrokerService in the same process.
first public Jun 30, 2026 · 1 source
Running Org.apache.activemq:activemq-broker? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Deployments of Apache ActiveMQ 5.x before 5.19.8 or 6.0.0 before 6.2.7 that use LDAP for broker configuration or authorization are the ones where an LDAP writer could reach the broker JVM. Teams that use only the file-based or simple authentication without LDAP lookup are less exposed. unknown whether the sources list other configurations that trigger the issue.
Not affected if fixed-version, no-ldap
Who cares apache-activemq, cwe-20, java, ldap, messaging
Improper Input Validation vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All.
An attacker that has access to publish or modify entries in LDAP that match the configured searchBase and searchFilter can instantiate denied transports inside the broker JVM. This can be used to fetch an attacker URL and spawn a second BrokerService inside the same JVM. This issue affects Apache ActiveMQ Broker: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7.
Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.
activemq-broker, apache-activemq or activemq-all.Upgrade to 5.19.8 · 6.2.7
activemq-broker, apache-activemq and activemq-all 5.x to 5.19.8.6.2.7.This page as .md · .json · in your agent: get_signal("CVE-2026-49434") · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.