{"id":"CVE-2026-108500","kind":"vulnerability","aliases":["CVE-2026-108500"],"related":[],"title":"Apache ActiveMQ: crafted destination names can skew LDAP authorization lookups","description":"Input validation vulnerability in Apache ActiveMQ configured to use the LDAPAuthorizationMapPlugin allows an authenticated attacker to create or address a destination with a crafted name containing LDAP DN special characters (such as comma, plus, equals, backslash) can manipulate the LDAP search base used for ACL lookups.\n\n\n\nThis issue affects Apache ActiveMQ: from 6.3.0 before 6.3.3, from 5.19.0 before 5.19.12.\n\n\n\nUsers are recommended to upgrade to version 6.4.0, 6.3.3 or 5.19.12, which fixes the issue.","summary":"Apache ActiveMQ configured with the LDAPAuthorizationMapPlugin does not sanitize destination names containing LDAP special characters. An authenticated user can use such a name to change the LDAP search base used for access-control lookups.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["activemq","java","ldap","messaging","package"],"not_affected_if":["default-config","no-ldap-authorization"],"how_to_check":"- Check the ActiveMQ version in use: affected are `6.3.0` before `6.3.3` and `5.19.0` before `5.19.12`.\n- Check whether the broker config loads `LDAPAuthorizationMapPlugin` (look for it in `activemq.xml`).","fix":"- Upgrade the 6.x line to `6.3.3` or `6.4.0`.\n- Upgrade the 5.x line to `5.19.12`.","status":"open","published_at":"2026-11-04T11:17:13+00:00","first_seen_at":"2026-11-04T11:26:45+00:00","triaged_at":"2026-11-04T11:27:48+00:00","updated_at":"2026-11-04T11:27:48+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-04T11:27:48Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the 6.x line to `6.3.3` or `6.4.0`.\n- Upgrade the 5.x line to `5.19.12`.","reach":"network","title":"Apache ActiveMQ: crafted destination names can skew LDAP authorization lookups","impact":"medium","summary":"Apache ActiveMQ configured with the LDAPAuthorizationMapPlugin does not sanitize destination names containing LDAP special characters. An authenticated user can use such a name to change the LDAP search base used for access-control lookups.","audience":"businesses","category":"package","nicknames":[],"who_cares":["activemq","java","messaging","ldap"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"authenticated user manipulates LDAP ACL lookups, gaining unauthorized destination access","analyst_note":"","how_to_check":"- Check the ActiveMQ version in use: affected are `6.3.0` before `6.3.3` and `5.19.0` before `5.19.12`.\n- Check whether the broker config loads `LDAPAuthorizationMapPlugin` (look for it in `activemq.xml`).","plain_action":"","needs_analyst":false,"not_affected_if":["no-ldap-authorization","default-config"],"who_is_affected":"Only brokers that use the LDAPAuthorizationMapPlugin for authorization are exposed; the attacker must already hold valid credentials to the broker. Brokers using other authorization plugins or no authorization plugin are not described as affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.00071,"input_tokens":4230,"output_tokens":573,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-108500':13A,16A '-2026':12A,15A '5.19.0':113C '5.19.12':115C,126C '6.3.0':109C '6.3.3':111C,124C '6.4.0':123C 'access':54B 'access-control':53B 'acl':101C 'activemq':2A,17B,23B,62C,107C 'address':75C 'affect':105C 'allow':68C 'apach':1A,22B,61C,106C 'attack':71C 'authent':38B,70C 'author':9A 'backslash':92C 'base':50B,98C 'chang':46B 'charact':36B,86C 'comma':89C 'configur':24B,63C 'contain':33B,82C 'control':55B 'craft':3A,80C 'creat':73C 'cve':11A,14A 'destin':4A,31B,77C 'dn':84C 'equal':91C 'fix':128C 'input':57C 'issu':104C,130C 'java':18B 'ldap':8A,19B,34B,48B,83C,96C 'ldapauthorizationmapplugin':27B,67C 'lookup':10A,56B,102C 'manipul':94C 'messag':20B 'name':5A,32B,44B,81C 'packag':21B 'plus':90C 'recommend':118C 'sanit':30B 'search':49B,97C 'skew':7A 'special':35B,85C 'upgrad':120C 'use':41B,51B,65C,99C 'user':39B,116C 'valid':58C 'version':122C 'vulner':59C","nicknames":[],"mitigations":[],"who_affected":"Only brokers that use the LDAPAuthorizationMapPlugin for authorization are exposed; the attacker must already hold valid credentials to the broker. Brokers using other authorization plugins or no authorization plugin are not described as affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["activemq","java","ldap","messaging","package","unknown"],"campaign_type":null,"first_public_at":"2026-11-04T11:17:13+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-108500","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108500","severity":null,"published_at":"2026-11-04T11:17:13+00:00","modified_at":"2026-11-04T11:17:13+00:00","first_seen_at":"2026-11-04T11:26:45+00:00","fetched_at":"2026-11-04T11:26:45+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}