Advisory [CVE-2026-111822] Improper invalidation of cached authorizations vulnerability in Apache ActiveMQ, Apache ActiveMQ Runtime Config
This security Apache Software Foundation advisory covers CVE-2026-111822 affecting Apache ActiveMQ.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Get an email when Apache Software Foundation Messaging (ActiveMQ/Kafka/Pulsar) publishes the next one.
See Apache Software Foundation Messaging (ActiveMQ/Kafka/Pulsar)'s last 90 days of advisories first. Then choose the free weekly digest, or a free month of real-time alerts with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
Summary
Improper invalidation of cached authorizations vulnerability in Apache ActiveMQ, Apache ActiveMQ Runtime Config.
After the runtime configuration plugin removes a principal's write grant on a destination, an authenticated connection opened before the change can keep sending to that destination, including through a new anonymous producer, while fresh connections and new explicit producers are denied.
This issue affects Apache ActiveMQ: from 6.0.0 before 6.3.3, before 5.19.12; Apache ActiveMQ Runtime Config: from 6.0.0 before 6.3.3, before 5.19.12.
Users are recommended to upgrade to version 6.4.0, 6.3.3 or 5.19.12, which fixes the issue.
- 6.0.0 before 6.3.3
Official advisory · medium-confidence parse· fetched 16 hours ago·verify at source
- 6.3.3
- 6.4.0
- 5.19.12
Official advisory · medium-confidence parse· fetched 16 hours ago·verify at source
Mitigation checklist
- Users are recommended to upgrade to version 6.4.0, 6.3.3 or 5.19.12, which fixes the issue.
Official advisory · medium-confidence parse· fetched 16 hours ago·verify at source
More Apache Software Foundation advisories
- CVE-2026-108500Nov 4, 2026Input validation vulnerability in Apache ActiveMQ configured to use
- CVE-2026-108946Nov 4, 2026Improper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDB
- CVE-2026-111821Nov 4, 2026Improper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDB
- CVE-2026-108949Nov 4, 2026Denial of Service via OOM vulnerability in Apache ActiveMQ, ActiveMQ Broker
- CVE-2026-49877Jun 30, 2026Apache ActiveMQ: Improper Authorization vulnerability in Apache ActiveMQ.
- CVE-2026-39304Apr 10, 2026Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ
Android app · Google Play
Monitor future Apache Software Foundation CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.