Vulnerability · Published Nov 4, 2026 · Assigned by apache
CVE-2026-111822Apache ActiveMQ, Apache ActiveMQ Runtime Config: ActiveMQ retains write access after live ACL revocation
Unrated
In plain English
A security flaw in Apache ActiveMQ from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).
Official description
Improper invalidation of cached authorizations vulnerability in Apache ActiveMQ, Apache ActiveMQ Runtime Config. After the runtime configuration plugin removes a principal's write grant on a destination, an authenticated connection opened before the change can keep sending to that destination, including through a new anonymous producer, while fresh connections and new explicit producers are denied. This issue affects Apache ActiveMQ: from 6.0.0 before 6.3.3, before 5.19.12; Apache ActiveMQ Runtime Config: from 6.0.0 before 6.3.3, before 5.19.12. Users are recommended to upgrade to version 6.4.0, 6.3.3 or 5.19.12, which fixes the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | activemq | no fix listed | DEBIAN-CVE-2026-111822 |
| Debian:13 | activemq | no fix listed | DEBIAN-CVE-2026-111822 |
| Ubuntu:24.04:LTS | activemq | no fix listed | UBUNTU-CVE-2026-111822 |
| Ubuntu:26.04:LTS | activemq | no fix listed | UBUNTU-CVE-2026-111822 |
| Ubuntu:26.10 | activemq | no fix listed | UBUNTU-CVE-2026-111822 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache ActiveMQ | 6.0.0 – before 6.3.30 – before 5.19.12 |
| Apache Software Foundation | Apache ActiveMQ Runtime Config | 6.0.0 – before 6.3.30 – before 5.19.12 |