CVE-2026-49157: Apache ActiveMQ: Authenticated low-privilege Web users retain Jolokia broker-management capability by default

Synopsis

Incorrect default permissions in Apache ActiveMQ allow any authenticated low-privilege web user to access the Jolokia JMX-over-HTTP endpoint and invoke broker management operations reserved for administrators. The vulnerability is reachable over the network and requires only a low-privilege account, with no additional interaction needed. A successful attacker can read sensitive broker state, modify queue configuration (adding or removing queues), and disrupt message delivery. A patched-image rebuild at versions 5.19.7 or 6.2.6 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The Jolokia endpoint is exposed over HTTP/HTTPS, so the attacker must be able to reach the ActiveMQ web console over the network.

• AuthenticationRequired

  Any low-privilege web-login account is sufficient; no administrative credentials are needed to trigger the vulnerable Jolokia operations.

• Victim interactionNot required

  The attacker makes direct HTTP requests to the Jolokia endpoint and does not need any action from another user.

• Attack complexityDetail

  Exploitation is reliable and condition-free; the attacker simply sends well-formed Jolokia operation requests using valid low-privilege credentials.

Blast Radius

• Reads broker internals exposed through Jolokia, including queue names, connection counts, and message metrics that may reveal sensitive operational data.
• Adds or removes queues on the broker, disrupting application message flows that depend on those queues.
• Invokes other broker management operations via Jolokia that are intended for administrators, enabling broad configuration tampering.
• Triggers conditions that crash or degrade the broker service by misusing management operations at scale.