Missing Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ.
Apache ActiveMQ Classic temporary destinations are expected to be isolated to the connection that created them. The isolation can be broken as this is only checked in the client, allowing a different connection to consume from another connection's temporary
destination.
This issue affects Apache ActiveMQ Broker: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7.
Users are recommended to upgrade to version 6.2.7, which fixes the issue.
References
| Link | Resource |
|---|---|
| https://lists.apache.org/thread/85f3q7mkh71y7qwyn6wvgw0bw4jl06ys | Vendor Advisory Mailing List |
| http://www.openwall.com/lists/oss-security/2026/06/29/15 | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
02 Jul 2026, 18:41
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:* cpe:2.3:a:apache:activemq_broker:*:*:*:*:*:*:*:* |
|
| References | () https://lists.apache.org/thread/85f3q7mkh71y7qwyn6wvgw0bw4jl06ys - Vendor Advisory, Mailing List | |
| References | () http://www.openwall.com/lists/oss-security/2026/06/29/15 - Third Party Advisory | |
| First Time |
Apache activemq
Apache Apache activemq Broker |
30 Jun 2026, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
30 Jun 2026, 12:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
30 Jun 2026, 11:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-06-30 11:16
Updated : 2026-07-02 18:41
NVD link : CVE-2026-54475
Mitre link : CVE-2026-54475
CVE.ORG link : CVE-2026-54475
JSON object : View
Products Affected
apache
- activemq
- activemq_broker
CWE
CWE-862
Missing Authorization