CVE-2026-49877: Apache ActiveMQ Web Console Privilege Escalation (CVSS 8.1)

Technical summary

The vulnerability stems from default Jetty configuration in Apache ActiveMQ that does not correctly restrict the /admin/* URL paths to administrative users only. An authenticated principal with low-privilege credentials can bypass role-based access control (RBAC) enforcement and reach administrative functionality in the Web Console. The flaw is classified as CWE-285 (Improper Authorization) and requires network access plus valid authentication credentials, making it a privilege escalation vector rather than an unauthenticated remote code execution risk. The CVSS 3.1 score of 8.1 reflects high confidentiality and integrity impact with low attack complexity.

Business impact

Attackers who obtain or are provisioned with low-privilege Web Console credentials—whether through phishing, insider threat, or credential compromise—can escalate to administrative capabilities without legitimate authorization. This enables unauthorized configuration changes, potential message tampering, querying sensitive data, or disruption of message broker operations. For organizations relying on ActiveMQ for critical messaging infrastructure (financial services, healthcare, logistics), this exposure could lead to data breaches, service interruption, or compliance violations if administrative audit trails are tampered with.

Affected systems

Apache ActiveMQ versions prior to 5.19.8 are affected. Additionally, the 6.0.0 through 6.2.6 release branches contain the flaw. Organizations running any production instance in these ranges should assess exposure. The Web Console must be enabled and exposed to users (even internally) for the risk to be exploitable; air-gapped or console-disabled deployments have reduced exposure.

Exploitability

Exploitation requires valid ActiveMQ Web Console credentials for a low-privilege user account. An attacker cannot exploit this remotely without authentication. However, once authenticated—through credential theft, insider access, or shared demo accounts—the privilege escalation is trivial and requires no special tools or code. The low attack complexity and lack of user interaction make this straightforward to exploit for anyone with basic web browser access to the console.

Remediation

Upgrade Apache ActiveMQ to version 5.19.8 or later for the 5.x branch, or to 6.2.7 or later for the 6.x branch. Both releases patch the Jetty configuration to properly enforce RBAC on administrative endpoints. Organizations unable to patch immediately should consider disabling the Web Console if not in use, or implementing network-level access controls (firewall rules, reverse proxy authentication) to restrict console access to administrative personnel only.

Patch guidance

1. Verify your current ActiveMQ version via bin/activemq --version or the Web Console footer. 2. Plan a maintenance window; stopping and restarting the broker is required. 3. Download the appropriate patched version (5.19.8 or 6.2.7+) from the Apache ActiveMQ download page. 4. Back up your existing ActiveMQ installation and configuration directory. 5. Extract the patched version, preserve your conf/ and data/ directories from the backup, then restart the broker. 6. Test Web Console access with a low-privilege test account to confirm admin paths are now inaccessible. 7. Review and audit any recent Web Console access logs for suspicious administrative activity.

Detection guidance

Monitor ActiveMQ Web Console access logs (typically in data/activemq.log) for requests to /admin/* endpoints from low-privilege user accounts. Implement alerting on successful authentication followed by attempts to access admin resources. Network intrusion detection signatures targeting unusual navigation patterns within the Web Console can help catch exploitation attempts. Additionally, review User and Group configurations in ActiveMQ; verify that only intended administrative users have admin role assignments and that Web Console access is restricted to trusted networks or VPNs.

Why prioritize this

This vulnerability merits high prioritization due to its CVSS 8.1 score and direct impact on confidentiality and integrity. The flaw enables straightforward privilege escalation with minimal attacker effort once credentials are obtained. Given that messaging brokers are often positioned in trust boundaries between internal systems, unauthorized admin access can cascade into broader infrastructure compromise. The presence of valid authentication does not reduce the severity—it underscores the need to compartmentalize user roles strictly.

Risk score, explained

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) yields 8.1 because the attack is network-accessible, has low complexity, requires only low-privilege authentication, and achieves high confidentiality and integrity impact (administrative control) without affecting availability. The lack of availability impact (A:N) prevents a critical rating, but the unscoped confidentiality and integrity breaches justify a HIGH severity band.

Frequently asked questions