Riskcovery

CVE-2026-49270

Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: Durable Subscription Disclosure via Crafted BrokerInfo (OpenWire)

State
Published
Severity
5.9 Medium
Published
Jun 1, 2026
Updated
Jun 1, 2026
Reserved
May 28, 2026

Read the record on cve.org

Description

Exposure of Sensitive Information Through Metadata vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All.

Brokers that are configured with a network connector with syncDurableSubs set to true, are vulnerable to an unauthenticated attacker who can receive a list of all durable topic subscriptions in the broker, including client identifiers, subscription names, topic destinations, and JMS selector expressions, by sending a BrokerInfo command. The broker incorrectly responds without first ensuring the connection is authenticated. This issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ All: before 5.19.7, from 6.0.0 before 6.2.6.

Users are recommended to upgrade to version 6.2.6 or 5.19.7, which fixes the issue.

Scores

CVSSScoreVectorSource
3.15.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NCISA-ADP

Weaknesses

  • CWE-1230 Exposure of Sensitive Information Through Metadata

Affected Products

ProductVersions
Apache ActiveMQ BrokerApache Software Foundation
  • 5.14.0 to before 5.19.7Affected
  • 6.0.0 to before 6.2.6Affected
Apache ActiveMQApache Software Foundation
  • 5.14.0 to before 5.19.7Affected
  • 6.0.0 to before 6.2.6Affected
Apache ActiveMQ AllApache Software Foundation
  • 5.14.0 to before 5.19.7Affected
  • 6.0.0 to before 6.2.6Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.