CVE-2026-24457

State: Published
Severity: 9.1 Critical
Published: Mar 5, 2026
Updated: Aug 5, 2026
Reserved: Jan 23, 2026

Description

An unsafe parsing of OpenMQ's configuration in OpenMQ versions <6.5.2 and <6.9.0, allows a remote attacker to read arbitrary files from a MQ Broker's server. A full exploitation could read unauthorized files of the OpenMQ’s host OS. In some scenarios RCE could be achieved. This is fixed in OpenMQ 6.5.2, 6.9.0, and in GlassFish 7.0.26, 7.1.1, and 8.0.2.

Scores

CVSS	Score	Vector	Source
3.1	9.1 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H	eclipse

Weaknesses

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-27 Path Traversal: 'dir/../../filename'

Affected Products

Product	Versions
Eclipse OpenMQEclipse Foundation	before 6.5.2Affected 6.6.0 to before 6.9.0Affected
Eclipse GlassFishEclipse Foundation	before 7.0.26Affected 7.1.0 to before 7.1.1Affected 8.0.0 to before 8.0.2Affected

References

https://gitlab.eclipse.org/security/cve-assignment/-/issues/84

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.