Read the docs
TI-2024-15423 Aliases CVE-2024-23321GHSA-q9w2-h4cw-8ghp

Apache RocketMQ: Unauthorized Exposure of Sensitive Data

Priority MEDIUM 42CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

For RocketMQ versions 5.2.0 and below, under certain conditions, there is a risk of exposure of sensitive Information to an unauthorized actor even if RocketMQ is enabled with authentication and authorization functions. An attacker, possessing regular user privileges or listed in the IP whitelist, could potentially acquire the administrator's account and password through specific interfaces. Such an action would grant them full control over RocketMQ, provided they have access to the broker IP address list. To mitigate these security threats, it is strongly advised that users upgrade to version 5.3.0 or newer. Additionally, we recommend users to use RocketMQ ACL 2.0 instead of the original RocketMQ ACL when upgrading to version Apache RocketMQ 5.3.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0089 59th percentileScored 2026-11-07
Fix Fixed org.apache.rocketmq:rocketmq-all (Maven): 5.3.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache RocketMQ4.5.2 – 5.2.0—No fix listedCNA
—org.apache.rocketmq:rocketmq-all (Maven)4.5.2 to before 5.3.05.3.0Patch availableGHSA-q9w2-h4cw-8ghp
  • Apache RocketMQ VendorApache Affected 4.5.2 – 5.2.0 Fixed in — No fix listed CNA
  • org.apache.rocketmq:rocketmq-all (Maven) Vendor— Affected 4.5.2 to before 5.3.0 Fixed in 5.3.0 Patch available GHSA-q9w2-h4cw-8ghp

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:rocketmq:*:*:*:*:*:*:*:*4.5.2 to before 5.3.0VulnerableApache
  • cpe:2.3:a:apache:rocketmq:*:*:*:*:*:*:*:* Versions 4.5.2 to before 5.3.0 Vulnerable ·Apache

Remediation

  • Fix · GHSA-q9w2-h4cw-8ghp org.apache.rocketmq:rocketmq-all (Maven) Fixed in 5.3.0 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 2 products
  • Red Hat build of Apache Camel for Spring Boot 3
  • Red Hat build of Apache Camel for Spring Boot 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-23321
  2. 2026-10-03 Alias added: GHSA-q9w2-h4cw-8ghp

References

Advisory 2

Other 3

  • TI-2023-16418 Apache RocketMQ: Possible remote code execution vulnerability when using the update configuration function KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-19180 Apache RocketMQ: Possible remote code execution when using the update configuration function CVSS 3.1CRITICAL 9.8
  • TI-2019-13114 Path traversal in Apache RocketMQ CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences