CVE-2026-24457
Published: 05 March 2026
Description
An unsafe parsing of OpenMQ's configuration, allows a remote attacker to read arbitrary files from a MQ Broker's server. A full exploitation could read unauthorized files of the OpenMQ’s host OS. In some scenarios RCE could be achieved.
Mitigating Controls (NIST 800-53 r5)AI
Directly addresses unsafe configuration parsing vulnerable to path traversal by requiring input validation at entry points to block arbitrary file read attempts.
Ensures timely identification, reporting, and correction of the specific flaw in OpenMQ's configuration parsing that enables remote arbitrary file reads.
Limits the MQ Broker process to least privilege file access, preventing reads of unauthorized host OS files even if path traversal succeeds.
Security SummaryAI
CVE-2026-24457 involves unsafe parsing of OpenMQ's configuration in the OpenMQ MQ Broker server. This vulnerability, published on 2026-03-05, enables a remote attacker to read arbitrary files from the broker server, potentially including unauthorized files from the host operating system. It is rated with a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H) and is associated with CWE-22 (Path Traversal) and CWE-27 (Directory Traversal).
A remote attacker can exploit this vulnerability over the network with low complexity, no privileges, and no user interaction required. Successful exploitation allows reading sensitive files from the MQ Broker server and host OS. In some scenarios, full exploitation could lead to remote code execution (RCE).
Mitigation details are available in the referenced advisory at https://gitlab.eclipse.org/security/cve-assignment/-/issues/84.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability enables remote exploitation of public-facing MQ broker (T1190) for arbitrary file reads from local system and host OS (T1005), compromising sensitive data, with potential RCE.