Eclipse Foundation Vulnerabilities and Affected Products
Vulnerabilities associated with Eclipse OpenMQ.
Products
Clear product- Eclipse Glassfish12 vulnerabilities
- ThreadX12 vulnerabilities
- NetX Duo11 vulnerabilities
- Eclipse Theia10 vulnerabilities
- Eclipse Jetty9 vulnerabilities
- Eclipse Milo6 vulnerabilities
- Jetty6 vulnerabilities
- Eclipse OMR4 vulnerabilities
- Eclipse Vert.x4 vulnerabilities
- Mosquitto4 vulnerabilities
- OpenJ94 vulnerabilities
- USBX4 vulnerabilities
- Eclipse CSI - PIA3 vulnerabilities
- Eclipse BaSyx2 vulnerabilities
- Eclipse KUKSA - Databroker2 vulnerabilities
- Eclipse Open VSX2 vulnerabilities
- Eclipse OpenJ92 vulnerabilities
- Eclipse OpenMQ2 vulnerabilities
- Eclipse ThreadX - NetX Duo2 vulnerabilities
- Glassfish2 vulnerabilities
- NextX Duo2 vulnerabilities
- Open J92 vulnerabilities
- Parsson2 vulnerabilities
- Vert.x2 vulnerabilities
- BlueChi1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-24457CRITICAL | Generated title:Eclipse OpenMQ Unsafe Configuration Parsing Path Traversal VulnerabilityAn unsafe parsing of OpenMQ's configuration in OpenMQ versions <6.5.2 and <6.9.0, allows a remote attacker to read arbitrary files from a MQ Broker's server. A full exploitation could read unauthorized files of the OpenMQ’s host OS. In some scenarios RCE could be achieved. This is fixed in OpenMQ 6.5.2, 6.9.0, and in GlassFish 7.0.26, 7.1.1, and 8.0.2. | CVSS9.1v3.1 | EPSS0.616% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-22886CRITICAL | Generated title:Eclipse OpenMQ Default Credentials Authentication BypassOpenMQ exposes a TCP-based management service (imqbrokerd) that by default requires authentication. However, the product ships with a default administrative account (admin/ admin) and does not enforce a mandatory password change on first use. After the first successful login, the server continues to accept the default password indefinitely without warning or enforcement. In real-world deployments, this service is often left enabled without changing the default credentials. As a result, a remot… | CVSS9.8v3.1 | EPSS0.402% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |