---
id: "CVE-2026-111822"
kind: "vulnerability"
aliases: ["CVE-2026-111822"]
title: "Apache ActiveMQ: revoked write permission still honored on old connections"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["activemq", "java", "messaging", "package", "self-hosted"]
not_affected_if: ["fixed-version", "no-runtime-config-plugin", "static-permissions"]
published_at: "2026-11-04T10:17:25+00:00"
first_seen_at: "2026-11-04T10:26:34+00:00"
updated_at: "2026-11-04T10:27:21+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111822", "first_seen_at": "2026-11-04T10:26:34+00:00"}]
---

# Apache ActiveMQ: revoked write permission still honored on old connections

After an administrator removes a user's write permission on a destination through the runtime configuration plugin, a connection opened before the change can keep publishing to that destination. Fresh connections and new explicit producers are correctly denied, so the flaw is limited to sessions that were already authenticated.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed ActiveMQ version, for example by looking at the `activemq` distribution directory name or running `activemq --version` where available.
- Confirm whether the Runtime Config plugin is in use (look for the runtime configuration plugin in the broker configuration).
- Check whether anonymous producers or long-lived authenticated connections are used against destination write grants.

## Fix

- Upgrade ActiveMQ 6.x installs from before `6.3.3` to `6.3.3` or `6.4.0`.
- Upgrade ActiveMQ 5.x installs from before `5.19.12` to `5.19.12`.
- Apache ActiveMQ Runtime Config is affected on the same version ranges.

## Timeline

- 2026-11-04T10:26:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111822

## From the sources

Improper invalidation of cached authorizations vulnerability in Apache ActiveMQ, Apache ActiveMQ Runtime Config.



After the runtime configuration plugin removes a principal's write grant on a destination, an authenticated connection opened before the change can keep sending to that destination, including through a new anonymous producer, while fresh connections and new explicit producers are denied.



This issue affects Apache ActiveMQ: from 6.0.0 before 6.3.3, before 5.19.12; Apache ActiveMQ Runtime Config: from 6.0.0 before 6.3.3, before 5.19.12.



Users are recommended to upgrade to version 6.4.0, 6.3.3 or 5.19.12, which fixes the issue.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_