CVE-2026-54475High· 7.5▾ TwilightApache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ have a Missing Authorization vulnerability
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
Last analysed / modified upstream
0.6%
Missing Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ.
Apache ActiveMQ Classic temporary destinations are expected to be isolated to the connection that created them. The isolation can be broken as this is only checked in the client, allowing a different connection to consume from another connection's temporary destination. This issue affects Apache ActiveMQ Broker: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7.
Users are recommended to upgrade to version 6.2.7, which fixes the issue.
org.apache.activemq:activemq-broker < 5.19.8org.apache.activemq:activemq-broker >= 6.0.0, < 6.2.7org.apache.activemq:activemq-all < 5.19.8org.apache.activemq:activemq-all >= 6.0.0, < 6.2.7org.apache.activemq:apache-activemq < 5.19.8org.apache.activemq:apache-activemq >= 6.0.0, < 6.2.7Upgrade to a patched release:
org.apache.activemq:activemq-broker 5.19.8org.apache.activemq:activemq-broker 6.2.7org.apache.activemq:activemq-all 5.19.8org.apache.activemq:activemq-all 6.2.7org.apache.activemq:apache-activemq 5.19.8org.apache.activemq:apache-activemq 6.2.7Connected by shared product, vendor, weakness, or advisory.
CVE-2026-49434High· 7.5Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All have an Improper Input Validation vulnerability
CVE-2026-50750High· 7.5Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All have a Denial of Service via Out of Memory vulnerability
CVE-2026-108949Medium· 6.5Apache ActiveMQ, ActiveMQ Broker: Repeated rejected temporary destination consumer requests can lead to broker OOM
CVE-2024-0829Medium· 4.3The Comments Extra Fields For Post,Pages and CPT plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 5.0
CVE-2026-82916High· 7.1Apache OFBiz: webtools xmldsdump exports any entity to any path
CVE-2026-82902Medium· 4.3Apache OFBiz: Unfiltered server-side URL fetch in webtools viewdatafile