Cyber Posture

CVE-2026-24457

Critical

Published: 05 March 2026

Published
05 March 2026
Modified
15 April 2026
KEV Added
Patch
CVSS Score 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
EPSS Score 0.0028 51.2th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

An unsafe parsing of OpenMQ's configuration, allows a remote attacker to read arbitrary files from a MQ Broker's server. A full exploitation could read unauthorized files of the OpenMQ’s host OS. In some scenarios RCE could be achieved.

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly addresses unsafe configuration parsing vulnerable to path traversal by requiring input validation at entry points to block arbitrary file read attempts.

prevent

Ensures timely identification, reporting, and correction of the specific flaw in OpenMQ's configuration parsing that enables remote arbitrary file reads.

prevent

Limits the MQ Broker process to least privilege file access, preventing reads of unauthorized host OS files even if path traversal succeeds.

Security SummaryAI

CVE-2026-24457 involves unsafe parsing of OpenMQ's configuration in the OpenMQ MQ Broker server. This vulnerability, published on 2026-03-05, enables a remote attacker to read arbitrary files from the broker server, potentially including unauthorized files from the host operating system. It is rated with a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H) and is associated with CWE-22 (Path Traversal) and CWE-27 (Directory Traversal).

A remote attacker can exploit this vulnerability over the network with low complexity, no privileges, and no user interaction required. Successful exploitation allows reading sensitive files from the MQ Broker server and host OS. In some scenarios, full exploitation could lead to remote code execution (RCE).

Mitigation details are available in the referenced advisory at https://gitlab.eclipse.org/security/cve-assignment/-/issues/84.

Details

CWE(s)

Affected Products

eclipse
openmq
≤ 6.5.1

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
Why these techniques?

Vulnerability enables remote exploitation of public-facing MQ broker (T1190) for arbitrary file reads from local system and host OS (T1005), compromising sensitive data, with potential RCE.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References