---
id: CVE-2026-111822
title: >-
  Apache ActiveMQ, Apache ActiveMQ Runtime Config: ActiveMQ retains write access
  after live ACL revocation
summary: >-
  Improper invalidation of cached authorizations vulnerability in Apache
  ActiveMQ, Apache ActiveMQ Runtime Config.




  After the runtime configuration plugin removes a principal's write grant on a
  destination, an authenticated connection op…
severity: none
vendor: Apache Software Foundation
product: 'org.apache.activemq:apache-activemq'
affected:
  - 'org.apache.activemq:apache-activemq >= 6.0.0 < 6.3.3'
  - 'org.apache.activemq:apache-activemq < 5.19.12'
  - 'org.apache.activemq:activemq-runtime-config >= 6.0.0 < 6.3.3'
  - 'org.apache.activemq:activemq-runtime-config < 5.19.12'
published: '2026-11-04'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T12:11:26.492Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-111822'
references:
  - url: 'https://lists.apache.org/thread/b5gop0kwsm4sr1pgdrfcd14q8hx942j5'
tags:
  - cve.org
ingestedAt: '2026-11-05T20:33:06.729Z'
---

## Overview

Improper invalidation of cached authorizations vulnerability in Apache ActiveMQ, Apache ActiveMQ Runtime Config.



After the runtime configuration plugin removes a principal's write grant on a destination, an authenticated connection opened before the change can keep sending to that destination, including through a new anonymous producer, while fresh connections and new explicit producers are denied.



This issue affects Apache ActiveMQ: from 6.0.0 before 6.3.3, before 5.19.12; Apache ActiveMQ Runtime Config: from 6.0.0 before 6.3.3, before 5.19.12.



Users are recommended to upgrade to version 6.4.0, 6.3.3 or 5.19.12, which fixes the issue.

## Affected

- `org.apache.activemq:apache-activemq >= 6.0.0 < 6.3.3`
- `org.apache.activemq:apache-activemq < 5.19.12`
- `org.apache.activemq:activemq-runtime-config >= 6.0.0 < 6.3.3`
- `org.apache.activemq:activemq-runtime-config < 5.19.12`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.