ORG.APACHE.ACTIVEMQ:ACTIVEMQ-BROKER · CVE-2026-54475 · Package
FIX → 5.19.8 · 6.2.7
Apache ActiveMQ Classic only checks temporary destination isolation on the client side, so a different connection can consume messages from another connection's temporary destination. An attacker who can connect to the broker can read messages meant for other clients.
first public Jun 30, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams that run Apache ActiveMQ Classic brokers, or ship applications that embed the broker or client libraries from these Maven artifacts, are exposed. Exposure needs a connection that can reach the broker and use temporary destinations; brokers used only inside a closed system with trusted clients are lower risk. Pure consumers of a managed broker service can skip it.
Missing Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ.
Apache ActiveMQ Classic temporary destinations are expected to be isolated to the connection that created them. The isolation can be broken as this is only checked in the client, allowing a different connection to consume from another connection's temporary destination. This issue affects Apache ActiveMQ Broker: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7.
Users are recommended to upgrade to version 6.2.7, which fixes the issue.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Not affected if managed-hosting, no-temporary-destinations, trusted-clients-only
Who cares activemq, cwe-862, java, maven, message-broker
activemq-broker, activemq-all or apache-activemq in your Maven dependencies, for example with mvn dependency:treeactivemq --version or the lib folder of the install5.19.8, or from 6.0.0 up to but not including 6.2.7Upgrade to 5.19.8 · 6.2.7
5.19.x: move to 5.19.86.x: move to 6.2.7GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.