ORG.APACHE.ACTIVEMQ:APACHE-ACTIVEMQ · CVE-2026-49877 · Package
FIX → 5.19.8 · 6.2.7
Apache ActiveMQ's default Jetty settings did not restrict /admin/* paths in the Web Console to administrators. An authenticated low-privilege web console user can therefore reach administrative pages they should not see.
first public Jun 30, 2026 · 2 sources
Running Org.apache.activemq:apache-activemq? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Brokers running Apache ActiveMQ 5.x before 5.19.8 or 6.x before 6.2.7 with the Web Console enabled and non-admin user accounts. The attacker needs valid credentials for a low-privilege console user. Teams on fixed versions, or with no such users, are not exposed.
Not affected if admin-only-users, fixed-version, no-web-console
Who cares activemq, cwe-285, java, jetty, self-hosted
activemq --version or the version in the broker's lib directory, and compare it with the affected ranges.Improper Authorization vulnerability in Apache ActiveMQ.
An authenticated low-privilege Web Console user by default can access /admin/* paths in the Web Console. The default Jetty settings incorrectly did not limit those paths to only admins. This issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7.
Upgrade to 5.19.8 · 6.2.7
5.19.8 for the 5.x line (affected before 5.19.8)6.2.7 for the 6.x line (affected from 6.0.0 before 6.2.7)Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-49877") · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.