Improper Input Validation in Apache ActiveMQ Affects User Connections

CVE-2026-108946

What is CVE-2026-108946?

An improper input validation vulnerability in Apache ActiveMQ and Apache ActiveMQ KahaDB allows authenticated clients to spoof user IDs. This enables attackers to consume messages from temporary queues or topics associated with another user, leading to unauthorized message interception. Furthermore, duplicate ConsumerId registrations are logged but do not prevent the attacker from disconnecting the victim's subscription. Additionally, the vulnerability permits forged acknowledgments to permanently delete in-flight, unacknowledged messages, potentially leading to data loss and service disruption. Users are advised to upgrade to versions 6.4.0, 6.3.3, or 5.19.12 to mitigate these risks.

References