Description
An unsafe parsing of OpenMQ's configuration in OpenMQ versions <6.5.2 and <6.9.0, allows a remote attacker to read arbitrary files from a MQ Broker's server. A full exploitation could read unauthorized files of the OpenMQ’s host OS. In some scenarios RCE could be achieved. This is fixed in OpenMQ 6.5.2, 6.9.0, and in GlassFish 7.0.26, 7.1.1, and 8.0.2.
Affected products
eclipse: openmq
References1
- gitlab.eclipse.org/security/cve-assignment/-/issues/84 Vendor Advisory
Metrics
- CVSS 3.1
-
9.8
CRITICAL
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 1% percentile: 54 · as of 12 November 2026
- CWE
- CWE-22CWE-27
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.