CVE-2026-24457 is a critical (CVSS 9.1) arbitrary file read in Eclipse OpenMQ, caused by unsafe parsing of its configuration. It is fixed in OpenMQ 6.5.2 and 6.9.0, and in GlassFish 7.0.26, 7.1.1 and 8.0.2. Upgrade to a fixed release and keep the broker off untrusted networks.
What's affected
The record says OpenMQ versions before 6.5.2, and before 6.9.0 on the newer line, are affected. Fixes are in OpenMQ 6.5.2 and 6.9.0, and in GlassFish 7.0.26, 7.1.1 and 8.0.2, since GlassFish bundles OpenMQ.
A remote attacker can read arbitrary files from the broker's server. The record adds that full exploitation could read unauthorized files from the host operating system, and that in some scenarios remote code execution could be achieved. The CVSS vector needs no privileges and no user interaction.
How to check if you're exposed
Find out whether you run OpenMQ directly or through GlassFish.
find / -name "imq*.jar" 2>/dev/null
The jar file names carry the OpenMQ version. For GlassFish, check the server version with its admin tools or the install directory name, and compare it with 7.0.26, 7.1.1 and 8.0.2. Include application servers inside container images.
For a quick look at your own dependencies, Safeguard's free in-browser dependency scan at https://gold.safeguard.sh/scan checks them against known CVEs in your browser.
What to do now
- Upgrade OpenMQ to 6.5.2 or 6.9.0, or the GlassFish release that bundles the fix.
- Do not expose the message broker to untrusted networks.
- Restrict network access to the broker ports to the applications that need them.
- Review what sensitive files the broker's service account can read, and reduce that.
Why it matters
The record lists CWE-22, path traversal, and CWE-27, a path traversal variant. The broker parses configuration unsafely, which lets a request reach files outside the places it should read from. File read on a message broker host can expose credentials, keys and configuration for other systems.
Because brokers sit in the middle of many applications, leaked secrets can spread the damage. The CVE is not in CISA's Known Exploited Vulnerabilities catalog. The record was assigned by the Eclipse Foundation.
Brokers hold more than messages
A message broker looks like plumbing, but it sits in the middle of many applications and tends to run with broad access. It reads configuration, holds credentials for the systems it connects to, and often runs on a server shared with other services. A file read flaw on that host can expose a lot more than queue contents.
The record says unsafe parsing of configuration lets a remote attacker read arbitrary files from the broker's server, and that in some scenarios code execution could follow. Treat that second part as a reason to act promptly and not as a worst case to dismiss.
Find every copy
OpenMQ is embedded in GlassFish, so you may run it without ever having installed it by name. List your GlassFish servers and their versions as well as standalone brokers. The fixed GlassFish versions are 7.0.26, 7.1.1 and 8.0.2. For the standalone broker, the fixed versions are 6.5.2 and 6.9.0, and which one applies depends on the line you run.
Limit what a file read can reach
Check which account the broker runs as, and what that account can read. Files such as application configuration, private keys and cloud credentials should not be readable by a service that does not need them. Move secrets into a secrets manager where possible, and keep the broker's working directory tight.
Network exposure
Message brokers should listen only on the interfaces that applications use. Confirm with a port scan from outside your network that broker ports are not open to the internet, and put internal brokers behind segmentation.
After the upgrade
Rotate any secrets stored in files the broker's account could read, if the old version was reachable by anyone you do not trust. Look at broker and web server logs for unusual requests around configuration endpoints. Then add the broker to your software inventory with its owner.
Quick check
Does GlassFish need patching too?
If you run GlassFish, yes. The fix is in GlassFish 7.0.26, 7.1.1 and 8.0.2.
Can this lead to code execution?
The record says in some scenarios it could. The main described impact is arbitrary file read.
Sources
Last reviewed: 19 October 2026.
