What is the CVSS score of CVE-2026-49270?

CVE-2026-49270 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-49270?

Yes, a patch is available for CVE-2026-49270. Update the affected software to the latest version immediately.

Apache ActiveMQ CVE-2026-49270

EUVD-2026-33573 MEDIUM

Exposure of Sensitive Information Through Metadata (CWE-1230)

2026-06-01 security@apache.org

GHSA-hf52-78x8-6w3w

Information Disclosure Apache Activemq Activemq Broker Red Hat

5.9

CVSS 3.1 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 01, 2026 - 15:25 vuln.today

CVSS changed

Jun 01, 2026 - 15:22 NVD

5.9 (MEDIUM)

Patch available

Jun 01, 2026 - 10:01 EUVD

CVE Published

Jun 01, 2026 - 09:16 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 01, 2026 - 09:16 nvd

MEDIUM 5.9

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

6 maven packages depend on org.apache.activemq:activemq-all (3 direct, 3 indirect)
21 maven packages depend on org.apache.activemq:activemq-broker (14 direct, 7 indirect)

Ecosystem-wide dependent count for version 6.0.0 and other introduced versions.

DescriptionCVE.org

Exposure of Sensitive Information Through Metadata vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All.

Brokers that are configured with a network connector with syncDurableSubs set to true, are vulnerable to an unauthenticated attacker who can receive a list of all durable topic subscriptions in the broker, including client identifiers, subscription names, topic destinations, and JMS selector expressions, by sending a BrokerInfo command. The broker incorrectly responds without first ensuring the connection is authenticated. This issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ All: before 5.19.7, from 6.0.0 before 6.2.6.

Users are recommended to upgrade to version 6.2.6 or 5.19.7, which fixes the issue.

AnalysisAI

Unauthenticated information disclosure in Apache ActiveMQ Broker allows remote attackers to enumerate all durable topic subscriptions - including client identifiers, subscription names, topic destinations, and JMS selector expressions - by sending a BrokerInfo command to a broker with syncDurableSubs enabled on a network connector. The broker incorrectly skips authentication before servicing the BrokerInfo request, exposing sensitive messaging infrastructure metadata. No public exploit identified at time of analysis, and EPSS stands at 0.02% (6th percentile), indicating very low current exploitation probability despite network-reachable attack vector.

Technical ContextAI

Apache ActiveMQ is an open-source message broker implementing the JMS (Java Message Service) specification. The vulnerability resides in the broker's network connector subsystem, specifically the syncDurableSubs feature, which is designed to synchronize durable topic subscription state across a network of brokers. The BrokerInfo command is part of the OpenWire protocol used for broker-to-broker communication. CWE-1230 (Exposure of Sensitive Information Through Metadata) describes the root cause: the broker exposes structured metadata - subscription names, client IDs, topic destinations, and JMS selector expressions - without first validating that the requesting connection has been authenticated. Affected CPE spans Apache ActiveMQ Broker and ActiveMQ All from version 5.14.0 before 5.19.7, and from 6.0.0 before 6.2.6.

RemediationAI

Vendor-released patch: upgrade to Apache ActiveMQ 6.2.6 (for the 6.x line) or 5.19.7 (for the 5.x line), as recommended by the Apache security advisory at https://lists.apache.org/thread/k3233c1x506z3w7x4z0dqvd86d4v2fr2. If immediate upgrade is not feasible, the primary compensating control is to set syncDurableSubs=false on all network connector configurations, which disables the vulnerable code path entirely; note this will prevent durable subscription state from synchronizing across a broker network, potentially affecting consumers relying on durable topic failover. Additionally, network-level controls restricting OpenWire protocol access (default TCP port 61616) to trusted broker peers only will reduce exposure by limiting who can send BrokerInfo commands to the broker.