CVE-2026-108500 · Package
NO FIX YET · SEE WHAT TO DO
Apache ActiveMQ configured with the LDAPAuthorizationMapPlugin does not sanitize destination names containing LDAP special characters. An authenticated user can use such a name to change the LDAP search base used for access-control lookups.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Only brokers that use the LDAPAuthorizationMapPlugin for authorization are exposed; the attacker must already hold valid credentials to the broker. Brokers using other authorization plugins or no authorization plugin are not described as affected.
Not affected if default-config, no-ldap-authorization
Who cares activemq, java, ldap, messaging
6.3.0 before 6.3.3 and 5.19.0 before 5.19.12.LDAPAuthorizationMapPlugin (look for it in activemq.xml).6.3.3 or 6.4.0.Input validation vulnerability in Apache ActiveMQ configured to use the LDAPAuthorizationMapPlugin allows an authenticated attacker to create or address a destination with a crafted name containing LDAP DN special characters (such as comma, plus, equals, backslash) can manipulate the LDAP search base used for ACL lookups.
This issue affects Apache ActiveMQ: from 6.3.0 before 6.3.3, from 5.19.0 before 5.19.12.
Users are recommended to upgrade to version 6.4.0, 6.3.3 or 5.19.12, which fixes the issue.
5.19.12.This page as .md · .json · in your agent: get_signal("CVE-2026-108500")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.