High [CVE-2026-54475] Information disclosure due to broken temporary destination isolation

Missing Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. Apache ActiveMQ Classic temporary destinations are expected to be isolated to the connection that created them.

The isolation can be broken as this is only checked in the client, allowing a different connection to consume from another connection's temporary destination. Users are recommended to upgrade to version 6.2.7, which fixes the issue.

Temporary destinations, which are designed to be private to a specific connection, can be accessed by other connections due to a missing authorization check. This allows an unauthorized connection to consume messages from another connection's temporary destination, leading to information disclosure.

Red Hat products ship Apache ActiveMQ Classic components as transitive dependencies. Red Hat AMQ Broker is based on Apache ActiveMQ Artemis, which has its own temporary destination implementation.

The Classic broker's temporary destination logic is not exercised at runtime in Red Hat product deployments. Red Hat severity: Important — CVSS 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L).

Weakness: CWE-1220. Affected Red Hat products: Red Hat Fuse 7.

Red Hat lists Red Hat AMQ Broker 7; Red Hat Data Grid 8; Red Hat Enterprise Linux 8; Red Hat JBoss Enterprise Application Platform Expansion Pack as not affected.