by Kastro CVE-2026-24457
Eclipse Foundation Eclipse OpenMQ — An unsafe parsing of OpenMQ's configuration in OpenMQ versions <6.5.2 and <6.9.0, allows a remote attacker to read arbitrary files from a…
Description · from the CVE record
An unsafe parsing of OpenMQ's configuration in OpenMQ versions <6.5.2 and <6.9.0, allows a remote attacker to read arbitrary files from a MQ Broker's server. A full exploitation could read unauthorized files of the OpenMQ’s host OS. In some scenarios RCE could be achieved. This is fixed in OpenMQ 6.5.2, 6.9.0, and in GlassFish 7.0.26, 7.1.1, and 8.0.2.
Affected
ProductAffectedFixed inSource
Eclipse OpenMQ< 6.5.26.5.2CNA
Eclipse OpenMQ6.6.0 – < 6.9.06.9.0CNA
Eclipse GlassFish< 7.0.267.0.26CNA
Eclipse GlassFish7.1.0 – < 7.1.17.1.1CNA
Eclipse GlassFish8.0.0 – < 8.0.28.0.2CNA
Scores by source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
eclipse (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial