Apache ActiveMQ retains write access after ACL revocation
Cached authorization flaw allows continued write access after live ACL removal in versions before 6.3.3.
60
Vulnerability1 · 1 read
CVE-2026-111822
Cached authorizations bypass in Apache ActiveMQ after ACL revocation
- CVSS 3.1
- 8.1 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
After the runtime configuration plugin removes a principal's write grant on a destination in Apache ActiveMQ, an authenticated connection opened before the change can keep sending messages, including through a new anonymous producer. Fresh connections and new explicit producers are denied. Attackers can maintain write access to destinations after ACL revocation on affected versions from 6.0.0 before 6.3.3 and before 5.19.12.
What to do: Upgrade to ActiveMQ 6.4.0, 6.3.3 or 5.19.12. No workaround mentioned.
| Product | Affected | Fixed in |
|---|---|---|
| Apache ActiveMQ | 6.0.0 before 6.3.3, before 5.19.12 | 6.4.0, 6.3.3 or 5.19.12 |
| Apache ActiveMQ Runtime Config | 6.0.0 before 6.3.3, before 5.19.12 | 6.4.0, 6.3.3 or 5.19.12 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Improper invalidation of cached authorizations vulnerability in Apache ActiveMQ, Apache ActiveMQ Runtime Config. After the runtime configuration plugin removes a principal's write grant on a destination, an authenticated connection opened before the change can keep sending to that destination, including through a new anonymous producer, while fresh connections and new explicit producers are denied. This issue affects Apache ActiveMQ: from 6.0.0 before 6.3.3, before 5.19.12; Apache ActiveMQ Runtime Config: from 6.0.0 before 6.3.3, before 5.19.12. Users are recommended to upgrade to version 6.4.0, 6.3.3 or 5.19.12, which fixes the issue.
- Weakness
- CWE-306
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N