Improper Invalidation of Cached Authorizations in Apache ActiveMQ
CVE-2026-111822

Currently unrated

Key Information:

Vendor: Apache
Status: Apache ActiveMQ; Apache ActiveMQ Runtime Config
Vendor: CVE Published:; 4 November 2026

What is CVE-2026-111822?

The improper invalidation of cached authorizations in Apache ActiveMQ allows authenticated connections, established prior to a change in the runtime configuration, to continue sending messages to destinations even after their write grants have been removed. This vulnerability can lead to unauthorized message transmission, enabling communication through a new anonymous producer, while any new connections or explicit producers are appropriately denied. Users are strongly advised to upgrade to versions 6.4.0, 6.3.3, or 5.19.12 to address this issue effectively.

Affected Version(s)

Apache ActiveMQ 6.0.0 < 6.3.3

Apache ActiveMQ 0 < 5.19.12

Apache ActiveMQ Runtime Config 6.0.0 < 6.3.3

References

https://lists.apache.org/thread/b5gop0kwsm4sr1pgdrfcd14q8...

vendor-advisory

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Nov 4, 2026
Vulnerability Reserved
Oct 16, 2026

Credit

hataehoon

CVE-2026-111822 Data

JSON