{"id":"CVE-2026-49434","kind":"vulnerability","aliases":["CVE-2026-49434","GHSA-h5gm-rvw6-2xpx"],"related":[],"title":"Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All have an Improper Input Validation vulnerability","description":"Improper Input Validation vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All.\n\nAn attacker that has access to publish or modify entries in LDAP that match the configured searchBase and searchFilter can instantiate denied transports inside the broker JVM. This can be used to fetch an attacker URL and spawn a second BrokerService inside the same JVM.\nThis issue affects Apache ActiveMQ Broker: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7.\n\n\nUsers are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.","summary":"Apache ActiveMQ lets an attacker who can publish or modify entries in the LDAP directory used by the broker instantiate denied transports inside the broker JVM. This can make the broker fetch an attacker-controlled URL and start a second BrokerService in the same process.","severity":"high","cvss":7.5,"epss":0.0063,"exploited":false,"exploited_at":null,"products":[{"name":"org.apache.activemq:activemq-broker","fixed":["5.19.8"],"affected":"< 5.19.8","ecosystem":"maven"},{"name":"org.apache.activemq:activemq-broker","fixed":["6.2.7"],"affected":">= 6.0.0, < 6.2.7","ecosystem":"maven"},{"name":"org.apache.activemq:apache-activemq","fixed":["5.19.8"],"affected":"< 5.19.8","ecosystem":"maven"},{"name":"org.apache.activemq:apache-activemq","fixed":["6.2.7"],"affected":">= 6.0.0, < 6.2.7","ecosystem":"maven"},{"name":"org.apache.activemq:activemq-all","fixed":["5.19.8"],"affected":"< 5.19.8","ecosystem":"maven"},{"name":"org.apache.activemq:activemq-all","fixed":["6.2.7"],"affected":">= 6.0.0, < 6.2.7","ecosystem":"maven"},{"name":"apache activemq","fixed":["5.19.8"],"affected":"< 5.19.8","ecosystem":"vendor"},{"name":"apache activemq","fixed":["6.2.7"],"affected":">= 6.0.0, < 6.2.7","ecosystem":"vendor"},{"name":"apache activemq broker","fixed":["5.19.8"],"affected":"< 5.19.8","ecosystem":"vendor"},{"name":"apache activemq broker","fixed":["6.2.7"],"affected":">= 6.0.0, < 6.2.7","ecosystem":"vendor"}],"ecosystems":["maven","vendor"],"tags":["apache-activemq","cwe-20","java","ldap","messaging","package"],"not_affected_if":["fixed-version","no-ldap"],"how_to_check":"- Check the ActiveMQ version in the broker's Maven dependencies or installed distribution, for example `activemq-broker`, `apache-activemq` or `activemq-all`.\n- Look for LDAP-based authorization or authentication settings (searchBase and searchFilter) in the broker configuration.","fix":"- Upgrade `activemq-broker`, `apache-activemq` and `activemq-all` 5.x to `5.19.8`.\n- Upgrade these artifacts 6.x to `6.2.7`.","status":"open","published_at":"2026-06-30T11:16:29+00:00","first_seen_at":"2026-11-04T15:32:56+00:00","triaged_at":"2026-11-04T15:34:42+00:00","updated_at":"2026-11-04T15:57:43+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-04T15:34:42Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `activemq-broker`, `apache-activemq` and `activemq-all` 5.x to `5.19.8`.\n- Upgrade these artifacts 6.x to `6.2.7`.","reach":"network","title":"Apache ActiveMQ: LDAP-writable attacker can start a broker and fetch code","impact":"high","summary":"Apache ActiveMQ lets an attacker who can publish or modify entries in the LDAP directory used by the broker instantiate denied transports inside the broker JVM. This can make the broker fetch an attacker-controlled URL and start a second BrokerService in the same process.","audience":"developers","category":"package","nicknames":[],"who_cares":["apache-activemq","java","messaging","ldap"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker runs a second broker and fetches code inside the JVM","analyst_note":"","how_to_check":"- Check the ActiveMQ version in the broker's Maven dependencies or installed distribution, for example `activemq-broker`, `apache-activemq` or `activemq-all`.\n- Look for LDAP-based authorization or authentication settings (searchBase and searchFilter) in the broker configuration.\n- unknown whether the sources give a specific command for checking exposure.","plain_action":"","needs_analyst":false,"not_affected_if":["fixed-version","no-ldap"],"who_is_affected":"Deployments of Apache ActiveMQ 5.x before 5.19.8 or 6.0.0 before 6.2.7 that use LDAP for broker configuration or authorization are the ones where an LDAP writer could reach the broker JVM. Teams that use only the file-based or simple authentication without LDAP lookup are less exposed. unknown whether the sources list other configurations that trigger the issue.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000805,"input_tokens":4686,"output_tokens":673,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-20':64B '-2026':16A,24A '-49434':17A,25A '2xpx':22A '5.19.8':180C,188C,197C,211C '6.0.0':182C,190C,199C '6.2.7':184C,192C,201C,209C 'access':132C 'activemq':2A,5A,7A,28A,32A,37A,41A,44A,48A,51A,53A,55A,58A,62B,70B,121C,124C,126C,177C,186C,194C 'activemq-all':43A,47A 'activemq-broker':27A,31A 'affect':175C 'all':45A,49A 'apach':1A,4A,6A,61B,69B,120C,123C,125C,176C,185C,193C 'apache':36A,40A,50A,52A,54A,57A 'apache-activemq':35A,39A,60B 'attack':73B,103B,129C,162C 'attacker-control':102B 'broker':3A,29A,33A,56A,59A,87B,93B,99B,122C,153C,178C 'brokerservic':110B,168C 'configur':143C 'control':104B 'cve':15A,23A 'cwe':63B 'deni':89B,149C 'directori':83B 'entri':79B,137C 'fetch':100B,160C 'fix':213C 'ghsa':19A 'ghsa-h5gm-rvw6-2xpx':18A 'h5gm':20A 'improp':11A,115C 'input':12A,116C 'insid':91B,151C,169C 'instanti':88B,148C 'issu':174C,215C 'java':65B 'jvm':94B,154C,172C 'ldap':66B,82B,139C 'let':71B 'make':97B 'match':141C 'messag':67B 'modifi':78B,136C 'org.apache.activemq':26A,30A,34A,38A,42A,46A 'packag':68B 'process':114B 'publish':76B,134C 'recommend':204C 'rvw6':21A 'searchbas':144C 'searchfilt':146C 'second':109B,167C 'spawn':165C 'start':107B 'transport':90B,150C 'upgrad':206C 'url':105B,163C 'use':84B,158C 'user':202C 'valid':13A,117C 'version':208C 'vulner':14A,118C","nicknames":[],"mitigations":[],"who_affected":"Deployments of Apache ActiveMQ 5.x before 5.19.8 or 6.0.0 before 6.2.7 that use LDAP for broker configuration or authorization are the ones where an LDAP writer could reach the broker JVM. Teams that use only the file-based or simple authentication without LDAP lookup are less exposed. unknown whether the sources list other configurations that trigger the issue.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["activemq","activemqbroker","apacheactivemq","apacheactivemqbroker","orgapacheactivemqactivemqall","orgapacheactivemqactivemqbroker","orgapacheactivemqapacheactivemq"],"ptokens":["activemq","all","apache","broker","org"],"labels":["apacheactivemq","cwe20","high","java","ldap","maven","messaging","package","vendor"],"campaign_type":null,"first_public_at":"2026-06-30T11:16:29+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-h5gm-rvw6-2xpx","url":"https://github.com/advisories/GHSA-h5gm-rvw6-2xpx","severity":"high","published_at":"2026-06-30T12:31:52+00:00","modified_at":"2026-11-04T15:29:31+00:00","first_seen_at":"2026-11-04T15:32:56+00:00","fetched_at":"2026-11-04T15:53:26+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-49434","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49434","severity":null,"published_at":"2026-06-30T11:16:29+00:00","modified_at":"2026-07-02T18:43:25+00:00","first_seen_at":"2026-11-04T15:57:43+00:00","fetched_at":"2026-11-04T15:57:43+00:00","note":null}],"documents":[{"id":68012,"url":"https://github.com/apache/activemq/pull/2077","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":68013,"url":"https://github.com/apache/activemq/commit/0927bcb99e18c517728898be9f125589653ee899","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":68014,"url":"https://github.com/apache/activemq/commit/ac3d06454bdf8b21db7ef419f42d17ab124a6008","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":68015,"url":"https://github.com/apache/activemq/commit/f055bcc1dcd4a4a76b731fef43829fff515a7fbf","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":68016,"url":"https://github.com/apache/activemq/releases/tag/activemq-5.19.8","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"},{"id":68017,"url":"https://github.com/apache/activemq/releases/tag/activemq-6.2.7","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"},{"id":68078,"url":"https://lists.apache.org/thread/hcjh7kdk4l85tb9ksmvcnkhso1ngj50o","title":"Vendor advisory: lists.apache.org","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: lists.apache.org"},{"id":68079,"url":"http://www.openwall.com/lists/oss-security/2026/06/29/8","title":"Third-party advisory: www.openwall.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.openwall.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}