CVE-2026-49877: Apache ActiveMQ: Authenticated web users retain admin access by default in the Web Console
Improper Authorization vulnerability in Apache ActiveMQ.
An authenticated low-privilege Web Console user by default can access /admin/ paths in the Web Console. The default Jetty settings incorrectly did not limit those paths to only admins. This issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7.
Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache ActiveMQto a version that resolves this vulnerability.Fixed in 6.2.7 - Upgrade
Upgrade
Apache ActiveMQto a version that resolves this vulnerability.Fixed in 5.19.8
Event History
Frequently Asked Questions
What is the severity of CVE-2026-49877?
CVE-2026-49877 has a high severity rating of 8.1 according to the CVSS 3.1 metrics.
What is the main issue in CVE-2026-49877?
CVE-2026-49877 involves improper authorization where authenticated low-privilege users can access admin paths in the Apache ActiveMQ Web Console.
How does CVE-2026-49877 affect Apache ActiveMQ?
CVE-2026-49877 affects Apache ActiveMQ versions before 5.19.8 and allows unauthorized access to admin functionalities.
How can I fix CVE-2026-49877?
To fix CVE-2026-49877, upgrade to Apache ActiveMQ version 5.19.8 or later to ensure proper access controls are enforced.
What type of vulnerability is CVE-2026-49877?
CVE-2026-49877 is classified as an Improper Authorization vulnerability.