CVE-2026-111822 · Package
NO FIX YET · SEE WHAT TO DO
After an administrator removes a user's write permission on a destination through the runtime configuration plugin, a connection opened before the change can keep publishing to that destination. Fresh connections and new explicit producers are correctly denied, so the flaw is limited to sessions that were already authenticated.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Teams running Apache ActiveMQ 6.0.0 up to 6.3.3, or 5.x before 5.19.12, with the Runtime Config plugin used to change destination permissions at runtime. The exposure requires an authenticated connection that was opened before a write grant was removed, so deployments with static permissions or short-lived connections are less exposed. Brokers on fixed versions or without runtime permission changes can skip it.
Not affected if fixed-version, no-runtime-config-plugin, static-permissions
Who cares activemq, java, messaging, self-hosted
activemq distribution directory name or running activemq --version where available.6.3.3 to 6.3.3 or 6.4.0.Improper invalidation of cached authorizations vulnerability in Apache ActiveMQ, Apache ActiveMQ Runtime Config.
After the runtime configuration plugin removes a principal's write grant on a destination, an authenticated connection opened before the change can keep sending to that destination, including through a new anonymous producer, while fresh connections and new explicit producers are denied.
This issue affects Apache ActiveMQ: from 6.0.0 before 6.3.3, before 5.19.12; Apache ActiveMQ Runtime Config: from 6.0.0 before 6.3.3, before 5.19.12.
Users are recommended to upgrade to version 6.4.0, 6.3.3 or 5.19.12, which fixes the issue.
5.19.12 to 5.19.12.This page as .md · .json · in your agent: get_signal("CVE-2026-111822")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.