CVE-2026-111822None▾ SunlitImproper invalidation of cached authorizations vulnerability in Apache ActiveMQ, Apache ActiveMQ Runtime Config. After the runtime configuration plugin removes a principal's write grant on a destination, an authenticated connection op…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Improper invalidation of cached authorizations vulnerability in Apache ActiveMQ, Apache ActiveMQ Runtime Config.
After the runtime configuration plugin removes a principal's write grant on a destination, an authenticated connection opened before the change can keep sending to that destination, including through a new anonymous producer, while fresh connections and new explicit producers are denied.
This issue affects Apache ActiveMQ: from 6.0.0 before 6.3.3, before 5.19.12; Apache ActiveMQ Runtime Config: from 6.0.0 before 6.3.3, before 5.19.12.
Users are recommended to upgrade to version 6.4.0, 6.3.3 or 5.19.12, which fixes the issue.
org.apache.activemq:apache-activemq >= 6.0.0 < 6.3.3org.apache.activemq:apache-activemq < 5.19.12org.apache.activemq:activemq-runtime-config >= 6.0.0 < 6.3.3org.apache.activemq:activemq-runtime-config < 5.19.12Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-108946NoneApache ActiveMQ, ActiveMQ Broker: The broker does not verify user provided connection id matches connection
CVE-2026-111821NoneApache ActiveMQ, Apache ActiveMQ KahaDB: Oversized client identifier strings poison the KahaDB journal
CVE-2026-52760Medium· 6.1Apache ActiveMQ, Apache ActiveMQ Web Console vulnerable to Cross-site Scripting
CVE-2026-49432High· 7.5Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp has an Improper Input Validation vulnerability
CVE-2026-49877High· 8.1Apache ActiveMQ Improper Authorization vulnerability
CVE-2026-53917High· 7.5Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker have Memory Allocation with Excessive Size Value vulnerability