{"id":"CVE-2026-49270","published":"2026-06-01T07:19:34Z","modified":"2026-06-01T13:11:12Z","title":"Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: Durable Subscription Disclosure via Crafted BrokerInfo…","vendor":"Apache","product":"Apache ActiveMQ Broker","tier":"tail","description":{"text":"Exposure of Sensitive Information Through Metadata vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All.\n\nBrokers that are configured with a network connector with syncDurableSubs set to true, are vulnerable to an unauthenticated attacker who can receive a list of all durable topic subscriptions in the broker, including client identifiers, subscription names, topic destinations, and JMS selector expressions, by sending a BrokerInfo command. The broker incorrectly responds without first ensuring the connection is authenticated.\nThis issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ All: before 5.19.7, from 6.0.0 before 6.2.6.\n\nUsers are recommended to upgrade to version 6.2.6 or 5.19.7, which fixes the issue.","provenance":"source","from":"CVE.org"},"cvss":{"score":5.9,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.00369,"percentile":0.3064,"provenance":"source"},"cwes":[{"id":"CWE-1230","name":"Exposure of Sensitive Information Through Metadata"}],"references":[{"url":"https://lists.apache.org/thread/k3233c1x506z3w7x4z0dqvd86d4v2fr2","tags":["vendor-advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/05/31/22","tags":[]}],"priority":{"score":10.3,"factors":[{"name":"EPSS percentile","points":6.13},{"name":"CVSS severity","points":4.13}]},"vendorSlug":"apache","affectedVersions":[{"vendor":"Apache Software Foundation","product":"Apache ActiveMQ Broker","versions":[">= 5.14.0, < 5.19.7",">= 6.0.0, < 6.2.6"]},{"vendor":"Apache Software Foundation","product":"Apache ActiveMQ","versions":[">= 5.14.0, < 5.19.7",">= 6.0.0, < 6.2.6"]},{"vendor":"Apache Software Foundation","product":"Apache ActiveMQ All","versions":[">= 5.14.0, < 5.19.7",">= 6.0.0, < 6.2.6"]}],"affected":[{"ecosystem":"Maven","package":"org.apache.activemq:apache-activemq","vulnerableRanges":["<5.19.7",">=6.0.0, <6.2.6"],"patched":["5.19.7","6.2.6"],"from":["GHSA-hf52-78x8-6w3w"],"provenance":"source"},{"ecosystem":"Maven","package":"org.apache.activemq:activemq-broker","vulnerableRanges":["<5.19.7",">=6.0.0, <6.2.6"],"patched":["5.19.7","6.2.6"],"from":["GHSA-hf52-78x8-6w3w"],"provenance":"source"},{"ecosystem":"Maven","package":"org.apache.activemq:activemq-all","vulnerableRanges":["<5.19.7",">=6.0.0, <6.2.6"],"patched":["5.19.7","6.2.6"],"from":["GHSA-hf52-78x8-6w3w"],"provenance":"source"}],"euvd":{"id":"EUVD-2026-33573","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2026-40466","published":"2026-04-24","fixed":"6.2.5","kev":false,"link":{"from":"CVE-2026-40466","to":"CVE-2026-49270","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.activemq:activemq-broker","fromFixed":"5.19.6","toFixed":"5.19.7","daysApart":38},{"kind":"version-step","provenance":"source","package":"Maven:org.apache.activemq:activemq-broker","fromFixed":"6.2.5","toFixed":"6.2.6","daysApart":38}]}},{"cve":"CVE-2026-41044","published":"2026-04-24","fixed":"6.2.5","kev":false},{"cve":"CVE-2026-42588","published":"2026-06-01","fixed":"6.2.6","kev":false},{"cve":"CVE-2026-45505","published":"2026-06-01","fixed":"6.2.6","kev":false},{"cve":"CVE-2026-49270","published":"2026-06-01","fixed":"6.2.6","kev":false}],"package":"Maven:org.apache.activemq:activemq-broker"}}