CVE-2026-49157: Apache ActiveMQ Jolokia Authorization Bypass Allows Privilege Escalation

Technical summary

CVE-2026-49157 stems from incorrect default authorization rules in the Jolokia interface integrated into Apache ActiveMQ. The vulnerability maps to CWE-276 (Incorrect Default Permissions). When Jolokia is enabled—which provides JMX access over HTTP—the default security configuration fails to restrict broker management operations to admin-level principals. This allows authenticated but unprivileged web users to invoke operations such as addQueue and removeQueue on the broker, effectively gaining administrative capabilities without proper authorization checks. The CVSS 3.1 vector (8.8 HIGH) reflects network accessibility, low attack complexity, low privileges required, and high impact across confidentiality, integrity, and availability.

Business impact

This vulnerability poses a direct threat to ActiveMQ deployment stability and operational security. An attacker with any valid web-login credential—even a low-privilege account created for limited purposes—can reconfigure broker queues, potentially disrupting message flows, deleting critical queues, or creating malicious ones to intercept messages. In environments where ActiveMQ is central to order processing, financial transactions, or real-time communications, unauthorized queue manipulation could cause service downtime, data loss, or message theft. The ability to execute broker management operations also creates audit and compliance risks, as unauthorized configuration changes may violate regulatory requirements.

Affected systems

Apache ActiveMQ versions 5.x up to and including 5.19.6, and all 6.x versions up to and including 6.2.5 are vulnerable. Organizations running ActiveMQ with Jolokia enabled (a common configuration for remote monitoring and management) and with multiple user accounts at varying privilege levels face the highest risk. Virtual and containerized deployments, cloud-hosted message brokers, and hybrid message queue architectures are equally exposed if they use these versions.

Exploitability

Exploitation requires only network access to the Jolokia HTTP endpoint and a valid low-privilege web-login credential. No special tools or complex attack chains are needed—the vulnerability is easily reachable through standard HTTP requests once a user is authenticated. The CVSS metric 'AC:L' (attack complexity low) and 'PR:L' (privileges low) underscore this. However, the vulnerability does require prior knowledge of valid credentials, which typically exists only within an organization or in scenarios where account provisioning is overly permissive. It is not currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, but the straightforward nature of the flaw makes it a natural target for both targeted insider threats and opportunistic external attackers who obtain credentials through phishing or other means.

Remediation

Upgrade Apache ActiveMQ to version 5.19.7 or later (for 5.x users) or version 6.2.6 or later (for 6.x users). These releases correct the default Jolokia authorization policy to properly enforce admin-only restrictions on broker management operations. If immediate upgrades are not feasible, restrict network access to the Jolokia endpoint using firewall rules, VPNs, or reverse proxies; disable Jolokia if it is not actively needed; and audit all web-login accounts to ensure only trusted administrators have access. Additionally, review and restrict the use of low-privilege accounts to only the minimum necessary permissions within your infrastructure.

Patch guidance

Verify the availability of ActiveMQ 5.19.7 or 6.2.6 (or later) through the official Apache ActiveMQ release page and your organization's software repository. Plan patching in coordination with your message broker maintenance windows to minimize disruption. For containerized deployments, rebuild images with the patched version and redeploy. For clustered ActiveMQ topologies, coordinate rolling updates to maintain availability. After patching, validate that Jolokia authorization rules are correctly enforced by testing with low-privilege accounts to confirm they can no longer execute broker management operations. Document the patch date and version for compliance and audit trails.

Detection guidance

Monitor Jolokia HTTP logs for calls to the addQueue, removeQueue, or other broker management methods originating from non-admin user sessions. Enable authentication and HTTP access logging on the Jolokia endpoint if not already active. Look for repeated or anomalous queue creation/deletion patterns, failed authorization attempts, or queue operations outside normal maintenance windows. In environments with centralized security logging, correlate Jolokia operation logs with user identity and privilege level. Implement alerting on any invocation of administrative broker operations by low-privilege accounts. Periodic audits of queue configuration against known baseline states can reveal unauthorized changes made through this vulnerability.

Why prioritize this

Although not yet in the KEV catalog, this vulnerability merits urgent remediation due to its high CVSS score (8.8), low barrier to exploitation, and direct impact on broker operations and message integrity. The requirement for valid credentials introduces some gating, but the ease of exploitation once credentials are obtained and the potential for severe operational disruption make it a priority above medium-risk issues. Organizations with strict message flow dependencies, compliance mandates, or multi-tenant ActiveMQ deployments should prioritize this fix within their critical patch cycle.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects: (1) Network-accessible Jolokia endpoint (AV:N), (2) low attack complexity with standard HTTP calls (AC:L), (3) requirement for low-level authenticated access (PR:L), (4) no user interaction needed (UI:N), (5) impact confined to a single system (S:U), and (6) high impact on all three security properties—an attacker can read broker state (confidentiality), modify queue configurations (integrity), and disable or degrade message processing (availability). The score appropriately captures the severity, though real-world risk depends on credential distribution and network segmentation in your environment.

Frequently asked questions