OpenMQ exposes a TCP-based management service (imqbrokerd) that by default requires authentication.

published 2026-03-03 8 mo ago modified 2026-06-17 4 mo ago also EUVD-2026-9283

cvss: 9.8; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.5%; EPSS 0.5% chance of exploitation in 30 days, percentile 39%
public exploits: 0; none known

OpenMQ exposes a TCP-based management service (imqbrokerd) that by default requires authentication. However, the product ships with a default administrative account (admin/ admin) and does not enforce a mandatory password change on first use. After the first successful login, the server continues to accept the default password indefinitely without warning or enforcement.

In real-world deployments, this service is often left enabled without changing the default credentials. As a result, a remote attacker with access to the service port could authenticate as an administrator and gain full control of the protocol’s administrative features.

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: total
Assessed: 8 mo ago (2026-03-03)

Exploit prediction

0.46% chance of exploitation in the next 30 days, higher than 39% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Eclipse Foundation Eclipse OpenMQ

Classification

Weakness

CWE-1392 Use of Default Credentials
CWE-1393 Use of Default Password
CWE-1391 Use of Weak Credentials

References

gitlab.eclipse.org /security/cve-assignment/-/issues/85
issue-tracking, vendor-advisory

Sources

CVE List CVE-2026-22886
NVD CVE-2026-22886

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.

Summary