{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-92609", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-09-16T14:02:31.719Z", "datePublished": "2026-09-25T07:44:10.137Z", "dateUpdated": "2026-09-25T13:25:46.744Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-09-25T07:44:10.137Z"}, "title": "Apache Qpid Broker-J: Missing HTTP-session renewal after successful authentication", "problemTypes": [{"descriptions": [{"description": "CWE-384 Session fixation", "lang": "en", "cweId": "CWE-384", "type": "CWE"}]}], "source": {"discovery": "EXTERNAL"}, "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Qpid Broker-J", "collectionURL": "https://repo.maven.apache.org/maven2", "packageName": "org.apache.qpid:qpid-broker-plugins-management-http", "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "10.1.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"value": "Session fixation in HTTP management authentication allows remote\u00a0attackers to gain unauthorized access to an authenticated management session via reuse of a session identifier retained across successful authentication.\n\nThis issue affects Apache Qpid Broker-J: through 10.1.0.\n\nUsers are recommended to upgrade to version 10.1.1, which fixes the issue.", "lang": "en", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<div>Session fixation in HTTP management authentication allows remote&nbsp;attackers to gain unauthorized access to an authenticated management session via reuse of a session identifier retained across successful authentication.</div><div>This issue affects Apache Qpid Broker-J: through 10.1.0.</div><div>Users are recommended to upgrade to version 10.1.1, which fixes the issue.</div>"}]}], "references": [{"url": "https://lists.apache.org/thread/93w83oro48cqokb24k8tkogyvtlqhqw6", "tags": ["vendor-advisory"]}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "important"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "credits": [{"lang": "en", "value": "Abhishek Kushwaha", "type": "reporter"}], "x_generator": {"engine": "Vulnogram 1.0.3"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/09/24/17"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-09-25T08:14:55.285Z"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-09-25T13:25:35.738895Z", "id": "CVE-2026-92609", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-25T13:25:46.744Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/09/24/17"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-09-25T08:14:55.285Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-92609", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-09-25T13:25:35.738895Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-25T13:25:18.967Z"}}], "cna": {"title": "Apache Qpid Broker-J: Missing HTTP-session renewal after successful authentication", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "reporter", "value": "Abhishek Kushwaha"}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "important"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Qpid Broker-J", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "10.1.0"}], "packageName": "org.apache.qpid:qpid-broker-plugins-management-http", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}], "references": [{"url": "https://lists.apache.org/thread/93w83oro48cqokb24k8tkogyvtlqhqw6", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.3"}, "descriptions": [{"lang": "en", "value": "Session fixation in HTTP management authentication allows remote\u00a0attackers to gain unauthorized access to an authenticated management session via reuse of a session identifier retained across successful authentication.\n\nThis issue affects Apache Qpid Broker-J: through 10.1.0.\n\nUsers are recommended to upgrade to version 10.1.1, which fixes the issue.", "supportingMedia": [{"type": "text/html", "value": "<div>Session fixation in HTTP management authentication allows remote&nbsp;attackers to gain unauthorized access to an authenticated management session via reuse of a session identifier retained across successful authentication.</div><div>This issue affects Apache Qpid Broker-J: through 10.1.0.</div><div>Users are recommended to upgrade to version 10.1.1, which fixes the issue.</div>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-384", "description": "CWE-384 Session fixation"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-09-25T07:44:10.137Z"}}}, "cveMetadata": {"cveId": "CVE-2026-92609", "state": "PUBLISHED", "dateUpdated": "2026-09-25T13:25:46.744Z", "dateReserved": "2026-09-16T14:02:31.719Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2026-09-25T07:44:10.137Z", "assignerShortName": "apache"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "org.apache.qpid:qpid-broker-plugins-management-http", "product": "Apache Qpid Broker-J", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "10.1.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@apache.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:qpid_broker-j:*:*:*:*:*:*:*:*", "matchCriteriaId": "952FA6B1-8568-468F-B6D2-311F977B2138", "versionEndExcluding": "10.1.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Session fixation in HTTP management authentication allows remote\u00a0attackers to gain unauthorized access to an authenticated management session via reuse of a session identifier retained across successful authentication.\n\nThis issue affects Apache Qpid Broker-J: through 10.1.0.\n\nUsers are recommended to upgrade to version 10.1.1, which fixes the issue."}], "id": "CVE-2026-92609", "lastModified": "2026-10-05T18:08:07.400", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-92609", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-09-25T13:25:35.738895Z", "version": "2.0.3"}}]}, "published": "2026-09-25T08:16:41.203", "references": [{"source": "security@apache.org", "tags": ["Vendor Advisory", "Mailing List"], "url": "https://lists.apache.org/thread/93w83oro48cqokb24k8tkogyvtlqhqw6"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2026/09/24/17"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-384"}], "source": "security@apache.org", "type": "Secondary"}]}

{"bugzilla": {"description": "apache-qpid-broker-j: org.apache.qpid/qpid-broker-plugins-management-http: Apache Qpid Broker-J: Unauthorized management session access via session fixation", "id": "2540982", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2540982"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-613", "details": ["A flaw was found in Apache Qpid Broker-J. The application does not renew session identifiers upon successful authentication, leading to a session fixation vulnerability in the HTTP management interface. A remote attacker can exploit this issue by establishing a session identifier prior to login and reusing it after a legitimate user authenticates. This allows an attacker to hijack the authenticated management session and perform unauthorized administrative actions."], "mitigation": {"lang": "en:us", "value": "Restrict access to the HTTP management port to trusted administrative hosts or localhost:\n1. Limit management port access using `firewalld` to allow only authorized administrative IP addresses:\n```\nfirewall-cmd --permanent --zone=trusted --add-source=<ADMIN_IP>\nfirewall-cmd --reload\n```\nAlternatively, configure the broker management HTTP connector to bind exclusively to localhost (`127.0.0.1`), or restrict external reachability using perimeter network controls.\n2. Caveats:\nRestricting access to the HTTP management interface will block administrative connections originating outside designated trusted networks or hosts.\nWarning: Modifying firewall rules and reloading the firewall configuration may temporarily interrupt active network connections."}, "name": "CVE-2026-92609", "package_state": [{"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Affected", "package_name": "qpid-broker-plugins-management-http", "product_name": "Red Hat Fuse 7"}], "public_date": "2026-09-25T07:44:10Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-92609\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-92609\nhttps://lists.apache.org/thread/93w83oro48cqokb24k8tkogyvtlqhqw6"], "statement": "This vulnerability is rated as Important because unauthorized actors can hijack legitimate administrative sessions to gain elevated control over the message broker. While full administrative access over the messaging infrastructure could compromise data confidentiality and integrity, exploitation requires tricking an authorized user into authenticating with a predetermined session identifier. In Red Hat JBoss Fuse environments, exposure is restricted to instances where the HTTP management console is actively enabled and accessible across the network.", "threat_severity": "Important"}