---
id: "CVE-2026-54475"
kind: "vulnerability"
aliases: ["CVE-2026-54475", "GHSA-mhp6-f224-j2c3"]
title: "Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ have a Missing Authorization vulnerability"
severity: "high"
cvss: 7.5
epss: 0.00563
exploited: false
status: "open"
category: "package"
products: [{"name": "org.apache.activemq:activemq-broker", "fixed": ["5.19.8"], "affected": "< 5.19.8", "ecosystem": "maven"}, {"name": "org.apache.activemq:activemq-broker", "fixed": ["6.2.7"], "affected": ">= 6.0.0, < 6.2.7", "ecosystem": "maven"}, {"name": "org.apache.activemq:activemq-all", "fixed": ["5.19.8"], "affected": "< 5.19.8", "ecosystem": "maven"}, {"name": "org.apache.activemq:activemq-all", "fixed": ["6.2.7"], "affected": ">= 6.0.0, < 6.2.7", "ecosystem": "maven"}, {"name": "org.apache.activemq:apache-activemq", "fixed": ["5.19.8"], "affected": "< 5.19.8", "ecosystem": "maven"}, {"name": "org.apache.activemq:apache-activemq", "fixed": ["6.2.7"], "affected": ">= 6.0.0, < 6.2.7", "ecosystem": "maven"}, {"name": "apache activemq", "fixed": ["5.19.8"], "affected": "< 5.19.8", "ecosystem": "vendor"}, {"name": "apache activemq", "fixed": ["6.2.7"], "affected": ">= 6.0.0, < 6.2.7", "ecosystem": "vendor"}, {"name": "apache activemq broker", "fixed": ["5.19.8"], "affected": "< 5.19.8", "ecosystem": "vendor"}, {"name": "apache activemq broker", "fixed": ["6.2.7"], "affected": ">= 6.0.0, < 6.2.7", "ecosystem": "vendor"}]
ecosystems: ["maven", "vendor"]
tags: ["activemq", "cwe-862", "java", "maven", "message-broker", "package"]
not_affected_if: ["managed-hosting", "no-temporary-destinations", "trusted-clients-only"]
published_at: "2026-06-30T11:16:30+00:00"
first_seen_at: "2026-11-05T17:38:59+00:00"
updated_at: "2026-11-05T17:40:05+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-mhp6-f224-j2c3", "first_seen_at": "2026-11-05T17:38:59+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54475", "first_seen_at": "2026-11-05T17:40:05+00:00"}]
exploit_sources: [{"type": "epss", "score": 0.00563, "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-54475"}]
---

# Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ have a Missing Authorization vulnerability

Apache ActiveMQ Classic only checks temporary destination isolation on the client side, so a different connection can consume messages from another connection's temporary destination. An attacker who can connect to the broker can read messages meant for other clients.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- maven:org.apache.activemq:activemq-broker affected < 5.19.8 fixed 5.19.8
- maven:org.apache.activemq:activemq-broker affected >= 6.0.0, < 6.2.7 fixed 6.2.7
- maven:org.apache.activemq:activemq-all affected < 5.19.8 fixed 5.19.8
- maven:org.apache.activemq:activemq-all affected >= 6.0.0, < 6.2.7 fixed 6.2.7
- maven:org.apache.activemq:apache-activemq affected < 5.19.8 fixed 5.19.8
- maven:org.apache.activemq:apache-activemq affected >= 6.0.0, < 6.2.7 fixed 6.2.7
- vendor:apache activemq affected < 5.19.8 fixed 5.19.8
- vendor:apache activemq affected >= 6.0.0, < 6.2.7 fixed 6.2.7
- vendor:apache activemq broker affected < 5.19.8 fixed 5.19.8
- vendor:apache activemq broker affected >= 6.0.0, < 6.2.7 fixed 6.2.7

## How to check

- Check the version of `activemq-broker`, `activemq-all` or `apache-activemq` in your Maven dependencies, for example with `mvn dependency:tree`
- Look at the broker version on the server, for example with `activemq --version` or the lib folder of the install
- Affected if the version is below `5.19.8`, or from `6.0.0` up to but not including `6.2.7`

## Fix

- Apache ActiveMQ Classic `5.19.x`: move to `5.19.8`
- Apache ActiveMQ Classic `6.x`: move to `6.2.7`

## Timeline

- 2026-11-05T17:38:59+00:00 ghsa https://github.com/advisories/GHSA-mhp6-f224-j2c3
- 2026-11-05T17:40:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-54475

## Documents

- [advisory] Vendor advisory: lists.apache.org https://lists.apache.org/thread/85f3q7mkh71y7qwyn6wvgw0bw4jl06ys
- [advisory] Third-party advisory: www.openwall.com http://www.openwall.com/lists/oss-security/2026/06/29/15
- [fix] Patch: github.com https://github.com/apache/activemq/commit/708c90f2c0f0d874649ea0f0454760668a8f90fc
- [fix] Patch: github.com https://github.com/apache/activemq/commit/d8c5672e224883a16465f8550d0e6d900bfa383c
- [fix] Patch: github.com https://github.com/apache/activemq/pull/2122
- [fix] Release: github.com https://github.com/apache/activemq/releases/tag/activemq-6.2.7
- [fix] Release: github.com https://github.com/apache/activemq/releases/tag/activemq-5.19.8
- [fix] Patch: github.com https://github.com/apache/activemq/commit/225dcb649c5994463df12549a3f4eb9f6c509b34

## From the sources

Missing Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ.

Apache ActiveMQ Classic temporary destinations are expected to be isolated to the connection that created them. The isolation can be broken as this is only checked in the client, allowing a different connection to consume from another connection's temporary
destination.
This issue affects Apache ActiveMQ Broker: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7.

Users are recommended to upgrade to version 6.2.7, which fixes the issue.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_