CVE-2026-49877: Apache ActiveMQ Auth Bypass Vulnerability

CVE-2026-49877 Overview

CVE-2026-49877 is an improper authorization vulnerability in the Apache ActiveMQ Web Console. Authenticated low-privilege users can reach /admin/* paths that should be restricted to administrators. The default Jetty configuration shipped with vulnerable releases fails to enforce role-based path restrictions.

The flaw affects Apache ActiveMQ versions before 5.19.8 and versions 6.0.0 through 6.2.6. Apache addressed the issue in ActiveMQ 5.19.8 and 6.2.7. The weakness is tracked under CWE-285: Improper Authorization.

Critical Impact
Any authenticated Web Console user can access administrative functions, enabling broker reconfiguration, queue manipulation, and disruption of messaging services.

Affected Products

Apache ActiveMQ versions prior to 5.19.8
Apache ActiveMQ versions 6.0.0 through 6.2.6
Deployments exposing the ActiveMQ Web Console with default Jetty settings

Discovery Timeline

2026-06-30 - CVE-2026-49877 published to the National Vulnerability Database
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-49877

Vulnerability Analysis

Apache ActiveMQ ships an embedded Jetty server that hosts the Web Console. The console segregates administrative operations under the /admin/* URL space and exposes lower-privilege views under other paths. Access control is enforced through Jetty security constraints defined in the console's web.xml and Jetty configuration.

In versions before 5.19.8 and in the 6.x branch before 6.2.7, the default Jetty configuration does not bind the /admin/* constraint to the admin role. As a result, any user who authenticates against the Web Console can invoke administrative endpoints. This grants access to broker management operations such as creating and deleting queues, purging messages, and manipulating destinations.

The vulnerability requires an authenticated session but no additional user interaction. Confidentiality and integrity of the messaging service are directly at risk, though the broker's core JMS listeners remain available.

Root Cause

The root cause is a missing security constraint mapping in the default Jetty descriptor. The console defines an admin role and an user role, but the constraint that should restrict /admin/* to the admin role was not applied by default. Authorization decisions therefore fall back to the broader authenticated-user policy, satisfying only the authentication check.

Attack Vector

An attacker requires valid Web Console credentials for any account, including read-only or monitoring accounts. After logging in, the attacker issues HTTP requests directly to endpoints under /admin/, such as queue creation, connection termination, and broker property changes. Because the console renders these endpoints for administrators, functional URLs are documented and easily reachable by any authenticated client.

See the Apache mailing list advisory and the OpenWall oss-security announcement for the vendor's technical description.

Detection Methods for CVE-2026-49877

Indicators of Compromise

Web Console access log entries showing requests to /admin/* from accounts not assigned the admin role.
Unexpected queue, topic, or connector modifications appearing in broker audit logs.
HTTP 200 responses to /admin/queues.jsp, /admin/deleteDestination.action, or similar management endpoints from non-administrator sessions.

Detection Strategies

Correlate Jetty access logs with the authenticated principal and role membership recorded in jetty-realm.properties or the configured JAAS realm.
Alert on any HTTP request to /admin/* where the session user does not belong to the admin role.
Baseline normal administrative activity by user and source IP, then flag deviations after ingesting Web Console logs into a centralized analytics platform.

Monitoring Recommendations

Forward ActiveMQ activemq.log and Jetty request logs to a SIEM or log analytics platform for continuous review.
Monitor for creation or deletion of queues and topics outside of change windows.
Track authentication events for accounts that suddenly begin issuing administrative HTTP requests.

How to Mitigate CVE-2026-49877

Immediate Actions Required

Upgrade Apache ActiveMQ to 5.19.8 or 6.2.7 as prescribed by the vendor.
Restrict network reachability of the Web Console to trusted management networks and VPNs.
Audit existing Web Console accounts and remove or disable non-essential low-privilege users until the patch is applied.
Rotate credentials for any account that may have been used to reach /admin/* endpoints prior to remediation.

Patch Information

Apache released fixed versions 5.19.8 and 6.2.7 that correct the default Jetty security constraint, binding /admin/* to the admin role. Details are published in the Apache ActiveMQ security advisory thread.

Workarounds

Manually edit the Web Console jetty.xml or web.xml to add a <security-constraint> that requires the admin role for URL pattern /admin/*.
Place a reverse proxy in front of the Web Console that blocks /admin/* for non-administrator identities.
Disable the Web Console entirely if it is not required for operations.

bash

# Example web.xml security-constraint for /admin/* (apply until upgrade)
# Edit $ACTIVEMQ_HOME/webapps/admin/WEB-INF/web.xml
<security-constraint>
  <web-resource-collection>
    <web-resource-name>Admin</web-resource-name>
    <url-pattern>/admin/*</url-pattern>
  </web-resource-collection>
  <auth-constraint>
    <role-name>admin</role-name>
  </auth-constraint>
</security-constraint>