HIGHFixed upstream

CVE-2026-49877

Apache ActiveMQ lets low-privilege web console users reach the admin pages by default

Technology

Apache ActiveMQ

CVSS Score

8.1 / 10.0

Affected Versions

before 5.19.8; 6.0.0 before 6.2.7

Upstream Fix

5.19.8 and 6.2.7

Published

June 30, 2026

OSSeva Coverage

Fixed upstream

Description

The default Jetty settings did not limit the /admin/* paths of the web console to administrators, so any authenticated low-privilege web console user could reach them. Apache rates the issue important; the 8.1 score on NVD is from CISA-ADP.

Upstream record: NVD · CVE.org

Is your Apache ActiveMQ deployment affected?

If you're running before 5.19.8; 6.0.0 before 6.2.7, you need this patch. Book a discovery call to get covered.

Book a discovery call View Apache ActiveMQ coverage →