{"id":"CVE-2026-54475","kind":"vulnerability","aliases":["CVE-2026-54475","GHSA-mhp6-f224-j2c3"],"related":[],"title":"Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ have a Missing Authorization vulnerability","description":"Missing Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ.\n\nApache ActiveMQ Classic temporary destinations are expected to be isolated to the connection that created them. The isolation can be broken as this is only checked in the client, allowing a different connection to consume from another connection's temporary\ndestination.\nThis issue affects Apache ActiveMQ Broker: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7.\n\nUsers are recommended to upgrade to version 6.2.7, which fixes the issue.","summary":"Apache ActiveMQ Classic only checks temporary destination isolation on the client side, so a different connection can consume messages from another connection's temporary destination. An attacker who can connect to the broker can read messages meant for other clients.","severity":"high","cvss":7.5,"epss":0.00563,"exploited":false,"exploited_at":null,"products":[{"name":"org.apache.activemq:activemq-broker","fixed":["5.19.8"],"affected":"< 5.19.8","ecosystem":"maven"},{"name":"org.apache.activemq:activemq-broker","fixed":["6.2.7"],"affected":">= 6.0.0, < 6.2.7","ecosystem":"maven"},{"name":"org.apache.activemq:activemq-all","fixed":["5.19.8"],"affected":"< 5.19.8","ecosystem":"maven"},{"name":"org.apache.activemq:activemq-all","fixed":["6.2.7"],"affected":">= 6.0.0, < 6.2.7","ecosystem":"maven"},{"name":"org.apache.activemq:apache-activemq","fixed":["5.19.8"],"affected":"< 5.19.8","ecosystem":"maven"},{"name":"org.apache.activemq:apache-activemq","fixed":["6.2.7"],"affected":">= 6.0.0, < 6.2.7","ecosystem":"maven"},{"name":"apache activemq","fixed":["5.19.8"],"affected":"< 5.19.8","ecosystem":"vendor"},{"name":"apache activemq","fixed":["6.2.7"],"affected":">= 6.0.0, < 6.2.7","ecosystem":"vendor"},{"name":"apache activemq broker","fixed":["5.19.8"],"affected":"< 5.19.8","ecosystem":"vendor"},{"name":"apache activemq broker","fixed":["6.2.7"],"affected":">= 6.0.0, < 6.2.7","ecosystem":"vendor"}],"ecosystems":["maven","vendor"],"tags":["activemq","cwe-862","java","maven","message-broker","package"],"not_affected_if":["managed-hosting","no-temporary-destinations","trusted-clients-only"],"how_to_check":"- Check the version of `activemq-broker`, `activemq-all` or `apache-activemq` in your Maven dependencies, for example with `mvn dependency:tree`\n- Look at the broker version on the server, for example with `activemq --version` or the lib folder of the install\n- Affected if the version is below `5.19.8`, or from `6.0.0` up to but not including `6.2.7`","fix":"- Apache ActiveMQ Classic `5.19.x`: move to `5.19.8`\n- Apache ActiveMQ Classic `6.x`: move to `6.2.7`","status":"open","published_at":"2026-06-30T11:16:30+00:00","first_seen_at":"2026-11-05T17:38:59+00:00","triaged_at":"2026-11-05T17:40:02+00:00","updated_at":"2026-11-05T17:40:05+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-05T17:40:02Z","model":"claude-haiku-5-5","output":{"fix":"- Apache ActiveMQ Classic `5.19.x`: move to `5.19.8`\n- Apache ActiveMQ Classic `6.x`: move to `6.2.7`","reach":"network","title":"Apache ActiveMQ: temporary destinations readable by other connections","impact":"medium","summary":"Apache ActiveMQ Classic only checks temporary destination isolation on the client side, so a different connection can consume messages from another connection's temporary destination. An attacker who can connect to the broker can read messages meant for other clients.","audience":"developers","category":"package","nicknames":[],"who_cares":["activemq","java","maven","message-broker"],"confidence":0.8,"fix_status":"available","needs_auth":"unknown","worst_case":"other clients read messages from temporary destinations they do not own","analyst_note":"","how_to_check":"- Check the version of `activemq-broker`, `activemq-all` or `apache-activemq` in your Maven dependencies, for example with `mvn dependency:tree`\n- Look at the broker version on the server, for example with `activemq --version` or the lib folder of the install\n- Affected if the version is below `5.19.8`, or from `6.0.0` up to but not including `6.2.7`","plain_action":"","needs_analyst":false,"not_affected_if":["managed-hosting","no-temporary-destinations","trusted-clients-only"],"who_is_affected":"Teams that run Apache ActiveMQ Classic brokers, or ship applications that embed the broker or client libraries from these Maven artifacts, are exposed. Exposure needs a connection that can reach the broker and use temporary destinations; brokers used only inside a closed system with trusted clients are lower risk. Pure consumers of a managed broker service can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000797,"input_tokens":4761,"output_tokens":642,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,23A '-54475':16A,24A '-862':61B '5.19.8':168C,177C,185C '6.0.0':170C,179C,187C '6.2.7':172C,181C,189C,197C 'activemq':2A,5A,8A,27A,31A,35A,39A,44A,48A,50A,52A,54A,57A,59B,69B,113C,116C,119C,121C,165C,174C,183C 'activemq-all':34A,38A 'activemq-broker':26A,30A 'affect':163C 'all':36A,40A 'allow':149C 'anoth':88B,156C 'apach':1A,4A,7A,68B,112C,115C,118C,120C,164C,173C,182C 'apache':43A,47A,49A,51A,53A,56A 'apache-activemq':42A,46A 'attack':94B 'author':12A,109C 'broken':140C 'broker':3A,28A,32A,55A,58A,66B,100B,114C,166C 'check':72B,145C 'classic':70B,122C 'client':78B,107B,148C 'connect':83B,89B,97B,132C,152C,157C 'consum':85B,154C 'creat':134C 'cve':14A,22A 'cwe':60B 'destin':74B,92B,124C,160C 'differ':82B,151C 'expect':126C 'f224':20A 'fix':199C 'ghsa':18A 'ghsa-mhp6-f224-j2c3':17A 'isol':75B,129C,137C 'issu':162C,201C 'j2c3':21A 'java':62B 'maven':63B 'meant':104B 'messag':65B,86B,103B 'message-brok':64B 'mhp6':19A 'miss':11A,108C 'org.apache.activemq':25A,29A,33A,37A,41A,45A 'packag':67B 'read':102B 'recommend':192C 'side':79B 'temporari':73B,91B,123C,159C 'upgrad':194C 'user':190C 'version':196C 'vulner':13A,110C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Apache ActiveMQ Classic brokers, or ship applications that embed the broker or client libraries from these Maven artifacts, are exposed. Exposure needs a connection that can reach the broker and use temporary destinations; brokers used only inside a closed system with trusted clients are lower risk. Pure consumers of a managed broker service can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["activemq","activemqbroker","apacheactivemq","apacheactivemqbroker","orgapacheactivemqactivemqall","orgapacheactivemqactivemqbroker","orgapacheactivemqapacheactivemq"],"ptokens":["activemq","all","apache","broker","org"],"labels":["activemq","cwe862","high","java","maven","messagebroker","package","vendor"],"campaign_type":null,"first_public_at":"2026-06-30T11:16:30+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-mhp6-f224-j2c3","url":"https://github.com/advisories/GHSA-mhp6-f224-j2c3","severity":"high","published_at":"2026-06-30T12:31:52+00:00","modified_at":"2026-11-05T17:36:23+00:00","first_seen_at":"2026-11-05T17:38:59+00:00","fetched_at":"2026-11-05T17:46:22+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-54475","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54475","severity":null,"published_at":"2026-06-30T11:16:30+00:00","modified_at":"2026-07-02T18:41:49+00:00","first_seen_at":"2026-11-05T17:40:05+00:00","fetched_at":"2026-11-05T17:40:05+00:00","note":null}],"documents":[{"id":78053,"url":"https://github.com/apache/activemq/pull/2122","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":78054,"url":"https://github.com/apache/activemq/commit/225dcb649c5994463df12549a3f4eb9f6c509b34","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":78055,"url":"https://github.com/apache/activemq/commit/708c90f2c0f0d874649ea0f0454760668a8f90fc","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":78056,"url":"https://github.com/apache/activemq/commit/d8c5672e224883a16465f8550d0e6d900bfa383c","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":68016,"url":"https://github.com/apache/activemq/releases/tag/activemq-5.19.8","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"},{"id":68017,"url":"https://github.com/apache/activemq/releases/tag/activemq-6.2.7","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"},{"id":78153,"url":"https://lists.apache.org/thread/85f3q7mkh71y7qwyn6wvgw0bw4jl06ys","title":"Vendor advisory: lists.apache.org","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: lists.apache.org"},{"id":78154,"url":"http://www.openwall.com/lists/oss-security/2026/06/29/15","title":"Third-party advisory: www.openwall.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.openwall.com"}],"exploit_sources":[{"type":"epss","score":0.00563,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-54475"}],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}