Apache ActiveMQ LDAPAuthorizationMap allows authorization bypass via DN injection (CVE-2026-108500)
Original title: CVE-2026-108500: Apache ActiveMQ: LDAPAuthorizationMap allows authorization bypass via DN injection
Authenticated attackers can create destinations with crafted DN names containing special characters in versions before 6.3.3 and 5.19.12.
A vulnerability in Apache ActiveMQ allows an authenticated attacker to bypass authorization by injecting LDAP DN special characters into destination names. The issue affects multiple versions of the ActiveMQ software. No public exploitation or patches are mentioned.
Impact: authorization bypass via crafted destination names
- CVEs
- CVE-2026-108500
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-108500 | DN injection in Apache ActiveMQ LDAPAuthorizationMapPlugin | — | — |
From the original article
Posted by Matt Pavlovich on Nov 03 Severity: Moderate Affected versions: - Apache ActiveMQ 6. 3. 0 before 6.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.