CVE-2026-108946: Apache ActiveMQ broker does not verify user provided connection ID (CVE-2026-108946)
Original title: CVE-2026-108946: Apache ActiveMQ, ActiveMQ Broker: The broker does not verify user provided connection id matches connection
User provided connection IDs are not validated against bound connection state in versions before 6.3.3 and 5.19.12.
Apache ActiveMQ and ActiveMQ Broker have an improper input validation vulnerability. The broker resolves connection, session and consumer state from user provided IDs. In some scenarios the IDs are not validated to ensure they are bound to the correct connection.
Unconfirmed: No exploitation in the wild or fixed versions stated
- No validation of user provided connection IDs
- Affects broker state resolution
- Versions before 6.3.3 and 5.19.12
Impact: Improper input validation leading to potential state confusion
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-108946 | Connection ID Spoofing in Apache ActiveMQ before 6.3.3 and 5.19.12 | 6.5 | — |
From the original article
Posted by Christopher L. Shannon on Nov 03 Severity: important Affected versions: - Apache ActiveMQ 6. 0.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.