Vulnerability · Published Mar 3, 2026 · Assigned by eclipse
CVE-2026-22886
Critical 9.8
In plain English
A critical-severity security flaw in Eclipse OpenMQ from Eclipse Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).
Official description
OpenMQ exposes a TCP-based management service (imqbrokerd) that by default requires authentication. However, the product ships with a default administrative account (admin/ admin) and does not enforce a mandatory password change on first use. After the first successful login, the server continues to accept the default password indefinitely without warning or enforcement. In real-world deployments, this service is often left enabled without changing the default credentials. As a result, a remote attacker with access to the service port could authenticate as an administrator and gain full control of the protocol’s administrative features.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Eclipse Foundation | Eclipse OpenMQ | 0 |
Weakness: CWE-1392, CWE-1393, CWE-1391 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H