CVE-2026-49157

A flaw was found in Apache ActiveMQ. The default authorization settings for Jolokia, a management interface, incorrectly allowed non-administrative web-login accounts to access and execute critical broker management operations. This could enable a low-privilege attacker to perform actions typically reserved for administrators, such as adding or removing queues, leading to unauthorized control over the message broker.

Red Hat products ship Apache ActiveMQ Classic components as transitive dependencies. The vulnerability is in the default Jolokia authorization settings on the Classic ActiveMQ web console, allowing non-admin web users to execute admin-only broker management operations via JMX-over-HTTP. The Classic web console with Jolokia is not deployed in any Red Hat product. Red Hat AMQ Broker is based on Apache ActiveMQ Artemis with its own management interface.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.