Apache ActiveMQ retains write access after ACL revocation
Original title: CVE-2026-111822: Apache ActiveMQ, Apache ActiveMQ Runtime Config: ActiveMQ retains write access after live ACL revocation
Cached authorization flaw allows continued write access after live ACL removal in versions before 6.3.3.
Apache ActiveMQ and Runtime Config versions before 6.3.3 and 5.19.12 suffer from improper invalidation of cached authorizations. After the runtime configuration plugin removes a principal's write grant on a destination, the vulnerability allows an attacker to retain write access. The issue is in the handling of authorization caches.
- Affected: Apache ActiveMQ 6.0.0 before 6.3.3
- Affected: Apache ActiveMQ before 5.19.12
- Affected: Apache ActiveMQ Runtime Config 6.0.0 before 6.3.3
- Affected: Apache ActiveMQ Runtime Config before 5.19.12
- 1.Upgrade to Apache ActiveMQ 6.3.3 or later
- 2.Upgrade to Apache ActiveMQ 5.19.12 or later
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111822 | Cached authorizations bypass in Apache ActiveMQ after ACL revocation | 8.1 | — |
From the original article
Posted by Christopher L. Shannon on Nov 03 Severity: important Affected versions: - Apache ActiveMQ 6. 0.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.