CVE-2026-54475: Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ have a Missing Authorization vulnerability
(updated )
Missing Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ.
Apache ActiveMQ Classic temporary destinations are expected to be isolated to the connection that created them. The isolation can be broken as this is only checked in the client, allowing a different connection to consume from another connection’s temporary destination. This issue affects Apache ActiveMQ Broker: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7.
Users are recommended to upgrade to version 6.2.7, which fixes the issue.
References
- github.com/advisories/GHSA-mhp6-f224-j2c3
- github.com/apache/activemq/commit/225dcb649c5994463df12549a3f4eb9f6c509b34
- github.com/apache/activemq/commit/708c90f2c0f0d874649ea0f0454760668a8f90fc
- github.com/apache/activemq/commit/d8c5672e224883a16465f8550d0e6d900bfa383c
- github.com/apache/activemq/pull/2122
- github.com/apache/activemq/releases/tag/activemq-5.19.8
- github.com/apache/activemq/releases/tag/activemq-6.2.7
- lists.apache.org/thread/85f3q7mkh71y7qwyn6wvgw0bw4jl06ys
- nvd.nist.gov/vuln/detail/CVE-2026-54475
Code Behaviors & Features
Detect and mitigate CVE-2026-54475 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →