CVE-2026-49434: Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: LdapNetworkConnector instantiates denied transports and a remote-properties broker
Improper Input Validation vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All.
An attacker that has access to publish or modify entries in LDAP that match the configured searchBase and searchFilter can instantiate denied transports inside the broker JVM. This can be used to fetch an attacker URL and spawn a second BrokerService inside the same JVM. This issue affects Apache ActiveMQ Broker: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7.
Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache ActiveMQ Brokerto a version that resolves this vulnerability.Fixed in 5.19.8 - Upgrade
Upgrade
Apache ActiveMQ Brokerto a version that resolves this vulnerability.Fixed in 6.2.7 - Upgrade
Upgrade
Apache ActiveMQto a version that resolves this vulnerability.Fixed in 5.19.8 - Upgrade
Upgrade
Apache ActiveMQto a version that resolves this vulnerability.Fixed in 6.2.7 - Upgrade
Upgrade
Apache ActiveMQ Allto a version that resolves this vulnerability.Fixed in 5.19.8 - Upgrade
Upgrade
Apache ActiveMQ Allto a version that resolves this vulnerability.Fixed in 6.2.7 - Compensating control
Mitigate the attack path by preventing attackers from publishing or modifying LDAP entries that match the configured searchBase and searchFilter used by LdapNetworkConnector (e.g., restrict write access to the relevant LDAP data and ensure only trusted principals can create/modify those entries).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-49434?
CVE-2026-49434 has a severity rating of high, with a CVSS score of 7.5.
How do I fix CVE-2026-49434?
To fix CVE-2026-49434, ensure that proper input validation is implemented for entries in LDAP that match the configured searchBase and searchFilter.
What are the potential risks associated with CVE-2026-49434?
The vulnerability could allow an attacker to instantiate denied transports inside the broker JVM, potentially compromising the system.
Which Apache products are affected by CVE-2026-49434?
CVE-2026-49434 affects Apache ActiveMQ Broker, Apache ActiveMQ, and Apache ActiveMQ All.
What kind of vulnerability is CVE-2026-49434 classified as?
CVE-2026-49434 is classified as an Improper Input Validation vulnerability.