CVE-2026-49270

Overview

Apache ActiveMQ (ActiveMQ Classic) is an open-source message broker maintained by the Apache Software Foundation. It supports the OpenWire, STOMP, AMQP 1.0 and MQTT protocols, fully supports JMS 1.1 with partial support for JMS 2.0 and Jakarta Messaging 3.1, and can connect brokers together into networks of brokers. Its modules are published as Maven artifacts under org.apache.activemq.

An information exposure vulnerability (CVE-2026-49270) has been identified in the ActiveMQ broker's network connector durable subscription synchronization, which allows unauthenticated attackers to obtain a list of all durable topic subscriptions on the broker, including client identifiers, subscription names, topic destinations, and JMS selector expressions. The Apache advisory identifies brokers configured with a network connector that has syncDurableSubs set to true as affected.

Per OWASP: Access control enforces policy such that users cannot act outside of their intended permissions. Failures typically lead to unauthorized information disclosure, modification, or destruction of all data or performing a business function outside the user's limits.

This issue affects multiple versions of ActiveMQ, all versions before 5.19.7, and from 6.0.0 up to but not including 6.2.6.

Details

Module Info

• Product: ActiveMQ
• Affected packages: org.apache.activemq:activemq-broker, org.apache.activemq:activemq-all, org.apache.activemq:apache-activemq
• Affected versions: <5.19.7, >=6.0.0 <6.2.6
• GitHub repository: https://github.com/apache/activemq
• Published packages: https://central.sonatype.com/artifact/org.apache.activemq/activemq-broker, https://central.sonatype.com/artifact/org.apache.activemq/activemq-all, https://central.sonatype.com/artifact/org.apache.activemq/apache-activemq
• Package manager: Maven
• Fixed in:
  • OSS ActiveMQ 5.19.7, 6.2.6
  • NES for ActiveMQ v5.16.10

Vulnerability Info

This Medium-severity vulnerability is found in the org.apache.activemq:activemq-broker package in multiple versions of ActiveMQ, and is also shipped in the activemq-all and apache-activemq distributions.

Brokers in a network of brokers exchange a BrokerInfo command when a connection is set up. When the broker receives a BrokerInfo that marks the connection as a network connection, TransportConnection.processBrokerInfo builds a NetworkBridgeConfiguration from the network properties carried in that BrokerInfo and, if syncDurableSubs is enabled in it and the peer advertises a recent enough OpenWire protocol version, immediately sends back a BrokerSubscriptionInfo command. That command carries the broker's durable topic subscriptions: client IDs, subscription names, destinations and selectors. The same logic runs for one-way and duplex network connections:

@Override
public Response processBrokerInfo(BrokerInfo info) {
    if (info.isSlaveBroker()) {
        LOG.error(" Slave Brokers are no longer supported - slave trying to attach is: {}", info.getBrokerName());
    } else if (info.isNetworkConnection() && !info.isDuplexConnection()) {
        try {
            NetworkBridgeConfiguration config = getNetworkConfiguration(info);
            if (config.isSyncDurableSubs() && protocolVersion.get() >= CommandTypes.PROTOCOL_VERSION_DURABLE_SYNC) {
                LOG.debug("SyncDurableSubs is enabled, Sending BrokerSubscriptionInfo");
                dispatchSync(NetworkBridgeUtils.getBrokerSubscriptionInfo(this.broker.getBrokerService(), config));
            }
        } catch (Exception e) {
            LOG.error("Failed to respond to network bridge creation from broker {}", info.getBrokerId(), e);
            return null;
        }
    } else if (info.isNetworkConnection() && info.isDuplexConnection()) {
        try {
            NetworkBridgeConfiguration config = getNetworkConfiguration(info);
            config.setBrokerName(broker.getBrokerName());

            if (config.isSyncDurableSubs() && protocolVersion.get() >= CommandTypes.PROTOCOL_VERSION_DURABLE_SYNC) {
                LOG.debug("SyncDurableSubs is enabled, Sending BrokerSubscriptionInfo");
                dispatchSync(NetworkBridgeUtils.getBrokerSubscriptionInfo(this.broker.getBrokerService(), config));
            }
            // ...

The broker authenticates a connection when it handles that connection's ConnectionInfo command, which passes the credentials through broker.addConnection() and the configured security plugins. processBrokerInfo does not check whether that has happened. It does not require a ConnectionInfo to have been accepted, and it does not check that the connection is registered. So a remote client that opens a transport connection and sends a crafted BrokerInfo before, or instead of, a valid ConnectionInfo receives the broker's durable subscription list without ever presenting credentials.

Mitigation

Only recent versions of ActiveMQ are community-supported. Older release lines are End-of-Life and will not receive public updates to address this issue. For more information see here.

Users of the affected components should apply one of the following mitigations:

• Upgrade to a currently supported ActiveMQ release line (5.19.x or 6.3.x) that contains the fix.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• Basel Khaled (finder)