TI-2023-16418 Aliases CVE-2023-33246 GHSA-x3cq-8f32-5f63

Apache RocketMQ: Possible remote code execution vulnerability when using the update configuration function

CRITICAL 100Exploited in the wildCWE-94Published 2023-05-24 · Updated 2025-10-21

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-94.

Summary

For RocketMQ versions 5.1.0 and below, under certain conditions, there is a risk of remote command execution. Several components of RocketMQ, including NameServer, Broker, and Controller, are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as. Additionally, an attacker can achieve the same effect by forging the RocketMQ protocol content. To prevent these attacks, users are recommended to upgrade to version 5.1.1 or above for using RocketMQ 5.x or 4.9.6 or above for using RocketMQ 4.x .

Why it matters now

Exploitation Active In CISA KEV since 2023-09-06CISA due date 2023-09-27

EPSS 0.96568 99th percentileScored 2026-11-07

Public exploit Yes 4 exploit referencesTagged by NVD

Fix Fixed org.apache.rocketmq:rocketmq-broker (Maven): 5.1.1org.apache.rocketmq:rocketmq-namesrv (Maven): 4.9.6, 5.1.1+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Active
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Apache	Apache RocketMQ	up to 5.1.0	—	No fix listed	CNA
—	org.apache.rocketmq:rocketmq-broker (Maven)	5.0.0 to before 5.1.1	5.1.1	Patch available	GHSA-x3cq-8f32-5f63
—	org.apache.rocketmq:rocketmq-namesrv (Maven)	4.0.0 to before 4.9.6	4.9.6	Patch available	GHSA-x3cq-8f32-5f63
—	org.apache.rocketmq:rocketmq-controller (Maven)	5.0.0 to before 5.1.1	5.1.1	Patch available	GHSA-x3cq-8f32-5f63
—	org.apache.rocketmq:rocketmq-namesrv (Maven)	5.0.0 to before 5.1.1	5.1.1	Patch available	GHSA-x3cq-8f32-5f63

Apache RocketMQ VendorApache Affected up to 5.1.0 Fixed in — No fix listed CNA
org.apache.rocketmq:rocketmq-broker (Maven) Vendor— Affected 5.0.0 to before 5.1.1 Fixed in 5.1.1 Patch available GHSA-x3cq-8f32-5f63
org.apache.rocketmq:rocketmq-namesrv (Maven) Vendor— Affected 4.0.0 to before 4.9.6 Fixed in 4.9.6 Patch available GHSA-x3cq-8f32-5f63
org.apache.rocketmq:rocketmq-controller (Maven) Vendor— Affected 5.0.0 to before 5.1.1 Fixed in 5.1.1 Patch available GHSA-x3cq-8f32-5f63
org.apache.rocketmq:rocketmq-namesrv (Maven) Vendor— Affected 5.0.0 to before 5.1.1 Fixed in 5.1.1 Patch available GHSA-x3cq-8f32-5f63

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:apache:rocketmq::::::::	before 4.9.6; 5.0.0 to before 5.1.1	Vulnerable	Apache

cpe:2.3:a:apache:rocketmq:*:*:*:*:*:*:*:* Versions before 4.9.6; 5.0.0 to before 5.1.1 Vulnerable ·Apache

Remediation

Fix · GHSA-x3cq-8f32-5f63 org.apache.rocketmq:rocketmq-broker (Maven) Fixed in 5.1.1 Advisory →
Fix · GHSA-x3cq-8f32-5f63 org.apache.rocketmq:rocketmq-namesrv (Maven) Fixed in 4.9.6 Advisory →
Fix · GHSA-x3cq-8f32-5f63 org.apache.rocketmq:rocketmq-controller (Maven) Fixed in 5.1.1 Advisory →
Fix · GHSA-x3cq-8f32-5f63 org.apache.rocketmq:rocketmq-namesrv (Maven) Fixed in 5.1.1 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2023-09-06 Added to CISA KEV
2026-10-02 Threatist record created from CVE-2023-33246
2026-10-03 Alias added: GHSA-x3cq-8f32-5f63

References

Exploit 4

Advisory 4

Other 3

TI-2023-19180 Apache RocketMQ: Possible remote code execution when using the update configuration function CVSS 3.1CRITICAL 9.8
TI-2024-15423 Apache RocketMQ: Unauthorized Exposure of Sensitive Data CVSS 3.1HIGH 8.8
TI-2019-13114 Path traversal in Apache RocketMQ CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences