CVE-2026-46605: Apache ActiveMQ server has an incomplete authorization workflow

June 1, 2026 (updated July 9, 2026)

Incomplete authorization by Apache ActiveMQ server before versions v6.2.6 and v5.19.7 allows authenticated connections to remove existing destinations with proper permissions.

This issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ All: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6.

Users are recommended to upgrade to version v6.2.6 or v5.19.7, which fixes the issue.

References

github.com/advisories/GHSA-cpw7-g3p5-qrfq
lists.apache.org/thread/l4lxgr2s73g9pb218f180psfyskf8ldm
nvd.nist.gov/vuln/detail/CVE-2026-46605

Code Behaviors & Features

Detect and mitigate CVE-2026-46605 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →