What is the CVSS score of CVE-2026-24457?

CVE-2026-24457 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Eclipse OpenMQ are affected by CVE-2026-24457?

The Eclipse OpenMQ message broker is vulnerable to unauthenticated remote file read attacks affecting any network-exposed instance, with documented potential for code execution escalation in certain…

How to fix or mitigate CVE-2026-24457?

Within 24 hours, audit your infrastructure to identify all Eclipse OpenMQ deployments, document their network exposure, and flag any internet-facing or untrusted-network-accessible instances for immediate isolation. Within 7 days, implement network segmentation using firewalls to restrict broker access to trusted internal networks only, disable unnecessary remote administration interfaces, and apply least-privilege access controls to the broker process user account. Within 30 days, collaborate with your vendor to evaluate available patches for your specific OpenMQ version, plan migration to a patched release when available, or prepare deployment of an alternative message queue platform to eliminate exposure from this unpatched critical vulnerability.

Eclipse OpenMQ CVE-2026-24457

CRITICAL

Path Traversal (CWE-22)

2026-03-05 emo@eclipse.org

Path Traversal Open Message Queue Eclipse

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Unauthenticated remote arbitrary file read gives C:H; I and A set to N because integrity/availability impact and RCE are only conditional, not confirmed.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 05, 2026 - 08:30 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 05, 2026 - 08:22 vuln.today

cvss_changed

CVSS changed

Aug 05, 2026 - 08:22 NVD

9.1 (CRITICAL) 9.8 (CRITICAL)

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 19:16 nvd

CRITICAL 9.1

DescriptionNVD

An unsafe parsing of OpenMQ's configuration, allows a remote attacker to read arbitrary files from a MQ Broker's server. A full exploitation could read unauthorized files of the OpenMQ’s host OS. In some scenarios RCE could be achieved.

AnalysisAI

Arbitrary file read in Eclipse Open Message Queue (OpenMQ) lets a remote attacker retrieve any file readable by the broker process by abusing unsafe parsing of the broker configuration, a path-traversal (CWE-22) weakness. Any network-exposed OpenMQ broker is affected without authentication, and the vendor notes that in some deployments the file-read primitive can be escalated to remote code execution. There is no public exploit identified at time of analysis, EPSS is low (0.26%, 49th percentile), and it is not listed in CISA KEV.

Technical ContextAI

OpenMQ is the open-source JMS message broker maintained under the Eclipse Foundation (formerly Sun/Oracle GlassFish Message Queue), used as the default JMS provider in GlassFish/Payara and in standalone messaging deployments. The flaw is a CWE-22 path traversal rooted in how the broker parses configuration input: attacker-controlled values are used to build filesystem paths without proper canonicalization or containment, so sequences such as '../' resolve outside the intended directory. The single affected CPE is cpe:2.3:a:eclipse:open_message_queue with all versions wildcarded, meaning no fixed lower/upper bound is encoded in NVD data yet. Because the broker process typically runs with broad filesystem access, the traversal exposes OS-level files (configuration, credentials, keys), and the vendor states configuration-parsing paths can, under some conditions, lead to code execution.

RemediationAI

No vendor-released patch version is identified at time of analysis, and the NVD CPE does not encode a fixed release, so the exact upgrade target must be confirmed via the Eclipse advisory at https://gitlab.eclipse.org/security/cve-assignment/-/issues/84 before deploying - do not assume a version number. As compensating controls, restrict network exposure of the broker's administration and portmapper ports (default 7676 plus the dynamically assigned service ports) so only trusted management hosts can reach them, place the broker behind a firewall or VPN rather than exposing it to untrusted networks (side effect: remote clients must connect through the trusted boundary), and run the broker under a low-privilege OS account with a minimal filesystem footprint so an arbitrary-read primitive yields fewer sensitive files (trade-off: tighter service accounts may require reconfiguring log and data paths). Rotate any credentials, keys, or secrets readable by the broker account in case they were already exposed, and monitor broker logs for anomalous configuration-parsing errors or traversal patterns.