CVE-2026-49270 Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All have an Exposure of Sensitive Information Through Metadata vulnerability

What is CVE-2026-49270?

CVE-2026-49270 is a medium-severity vulnerability in Apache Activemq, published on 1 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Exposure of Sensitive Information Through Metadata vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All.

Brokers that are configured with a network connector with syncDurableSubs set to true, are vulnerable to an unauthenticated attacker who can receive a list of all durable topic subscriptions in the broker, including client identifiers, subscription names, topic destinations, and JMS selector expressions, by sending a BrokerInfo command. The broker incorrectly responds without first ensuring the connection is authenticated. This issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ All: before 5.19.7, from 6.0.0 before 6.2.6.

Users are recommended to upgrade to version 6.2.6 or 5.19.7, which fixes the issue.

Weakness: CWE-1230

Which versions are affected by CVE-2026-49270?

13 open source packages ship an affected version, including org.apache.activemq:activemq-all, activemq and org.apache.activemq:activemq-broker. It affects 2 products.

Products include Apache Activemq, Apache Activemq Broker.

How do I fix CVE-2026-49270?

Upgrade org.apache.activemq:activemq-all to a fixed version for your release line: 5.19.7 or 6.2.6.

Is CVE-2026-49270 being exploited?

There is no known exploitation of CVE-2026-49270 in the wild and no public exploit code.

Other vulnerabilities in Apache Activemq

• CVE-2023-46604 Apache ActiveMQ Deserialization of Untrusted Data Exploited Critical 10.0
• CVE-2016-3088 Apache ActiveMQ Improper Input Validation Exploited Critical 9.8
• CVE-2026-34197 Apache ActiveMQ Improper Input Validation Exploited High 8.8
• CVE-2020-11998 Remote code execution in Apache ActiveMQ Critical 9.8
• CVE-2013-7285 Command Injection in Xstream Critical 9.8

All Apache Activemq vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-activemq-2026-49270, DEBIAN-CVE-2026-49270, GHSA-hf52-78x8-6w3w, MINI-7w86-xx6j-7mpr, MINI-cp79-c43j-5jqg, MINI-rv7c-vx47-w2f5 and 3 more.