DEBIAN-CVE-2026-49157

See a problem?
Please try reporting it to the source first.

Source

https://security-tracker.debian.org/tracker/CVE-2026-49157

Import Source

https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-49157.json

JSON Data

https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-49157

Upstream

CVE-2026-49157

Published

2026-06-01T09:16:20Z

Modified

2026-09-14T17:03:43Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

Incorrect Default Permissions vulnerability in Apache ActiveMQ. This issue affects Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6. The default Jolokia authorization settings granted non-admin (low-privilege) web-login accounts access to Jolokia operations which allowed executing broker management operations meant for admins such as addQueue and removeQueue. Users are recommended to upgrade to version 6.2.6 or 5.19.7, which fixes the issue.

References

https://security-tracker.debian.org/tracker/CVE-2026-49157

Affected packages

Debian:12 / activemq

Package

Name: activemq
Purl: pkg:deb/debian/activemq?arch=source&distro=bookworm

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

5.*

5.17.2+dfsg-2

5.17.2+dfsg-2+deb12u1

5.17.6+dfsg-1

5.17.6+dfsg-2

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-49157.json"

Debian:13 / activemq