CVE-2026-49877

Overview

Apache ActiveMQ Classic is an open-source Java message broker that provides asynchronous messaging for applications. It supports JMS 1.1 and multiple wire protocols, including OpenWire, AMQP, MQTT and STOMP. Broker and client components are published as Maven artifacts under org.apache.activemq. ActiveMQ Classic is distinct from Apache ActiveMQ Artemis, which has its own broker implementation and release lines.

An incorrectly configured access control vulnerability (CVE-2026-49877) has been identified in the default Web Console configuration of the Apache ActiveMQ Classic distribution, which allows attackers with a low-privilege Web Console account to access the /admin/* pages that are intended for administrators only.

Per OWASP: Access control enforces policy such that users cannot act outside of their intended permissions. Failures typically lead to unauthorized information disclosure, modification, or destruction of all data or performing a business function outside the user's limits.

This issue affects multiple versions of Apache ActiveMQ Classic.

‍

Details

Module Info

• Product: Apache ActiveMQ Classic
• Affected packages: org.apache.activemq:apache-activemq
• Affected versions: <5.19.8, >=6.0.0 <6.2.7
• GitHub repository: https://github.com/apache/activemq
• Published packages: https://central.sonatype.com/artifact/org.apache.activemq/apache-activemq
• Package manager: Maven
• Fixed in:
  • OSS Apache ActiveMQ Classic 5.19.8, 6.2.7
  • NES for ActiveMQ 5.16.8-activemq-5.16.12

Vulnerability Info

This High-severity vulnerability is found in the org.apache.activemq:apache-activemq package in multiple versions of Apache ActiveMQ Classic. The distribution ships a default Jetty configuration, conf/jetty.xml, that protects the Web Console with two security constraints. The general constraint allows both the user and admin roles, while the admin-only constraint is meant to restrict the console to the admin role. However, the admin-only constraint is mapped only to the *.action path pattern:

<bean id="securityConstraint" class="org.eclipse.jetty.util.security.Constraint">
    <property name="name" value="BASIC" />
    <property name="roles" value="user,admin" />
    <property name="authenticate" value="true" />
</bean>
<bean id="adminSecurityConstraint" class="org.eclipse.jetty.util.security.Constraint">
    <property name="name" value="BASIC" />
    <property name="roles" value="admin" />
    <property name="authenticate" value="true" />
</bean>
<bean id="securityConstraintMapping" class="org.eclipse.jetty.security.ConstraintMapping">
    <property name="constraint" ref="securityConstraint" />
    <property name="pathSpec" value="/,/api/*,*.jsp,*.html,*.js,*.css,*.png,*.gif,*.ico" />
</bean>
<bean id="adminSecurityConstraintMapping" class="org.eclipse.jetty.security.ConstraintMapping">
    <property name="constraint" ref="adminSecurityConstraint" />
    <property name="pathSpec" value="*.action" />
</bean>

Only requests ending in .action require the admin role. Every other Web Console page under /admin/*, such as the read-only pages for queue listings and message browsing, falls under the general constraint and is served to any authenticated user holding the user role. A low-privilege account, including the user account defined in the default jetty-realm.properties, can therefore log in and read broker administration data that the configuration intends to reserve for administrators. Because the restriction is defined in the default configuration rather than in code, a deployment that started from the shipped conf/jetty.xml stays exposed until that mapping is changed.

‍

Mitigation

Inactive versions of Apache ActiveMQ Classic are End-of-Life and will not receive updates to address this issue. For more information, see here.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to a currently supported release of Apache ActiveMQ Classic that contains the fix.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• Leon Johnson (finder)