Skip to content
fr Sign in
9.1 Critical

CVE-2026-24457 An unsafe parsing of OpenMQ's configuration in OpenMQ…

Description

An unsafe parsing of OpenMQ's configuration in OpenMQ versions <6.5.2 and <6.9.0, allows a remote attacker to read arbitrary files from a MQ Broker's server. A full exploitation could read unauthorized files of the OpenMQ’s host OS. In some scenarios RCE could be achieved. This is fixed in OpenMQ 6.5.2, 6.9.0, and in GlassFish 7.0.26, 7.1.1, and 8.0.2.

Affected products and versions

Product Affected versions Fixed in
Eclipse OpenMQ 6.6 6.6.0 → < 6.9.0 6.9.0
Eclipse OpenMQ 6.5 earliest → < 6.5.2 6.5.2
Eclipse Glassfish 8.0 8.0.0 → < 8.0.2 8.0.2
Eclipse Glassfish 7.1 7.1.0 → < 7.1.1 7.1.1
Eclipse Glassfish 7.0 earliest → < 7.0.26 7.0.26

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Eclipse OpenMQ

The 2 CVEs of Eclipse OpenMQ →
CVE-2026-22886 OpenMQ exposes a TCP-based management service (imqbrokerd) that by default requires authentication 9.8 Critical
Track this CVE