CVE-2026-108946

Full vulnerability record from the local CVENow database.

Description

Improper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDB. The ActiveMQ broker resolves connection, session and consumer state from ids that are user provided and in some scenarios does not validate that they ids are bound to that user. This allows an authenticated client to spoof another user's ids. This allows: * an authenticated client consumes from another connection's temporary queue/topic by putting the victim's connection id in its own ConsumerId, bypassing the broker-side ownership check. * a duplicate ConsumerId registration is only logged, after which the attacker's RemoveInfo or disconnect tears down the victim's live subscription * a forged MessageAck for the victim's ConsumerId permanently deletes an in-flight, unacknowledged message. This issue affects Apache ActiveMQ: from 6.0.0 before 6.3.3, before 5.19.12; Apache ActiveMQ KahaDB: from 6.0.0 before 6.3.3, before 5.19.12. Users are recommended to upgrade to version 6.4.0, 6.3.3, or 5.19.12, which fixes the issue.

Severity

Not scored

CVSS score

Not available

Vulnerability status

Received

Source identifier

[email protected]

Published

2026-11-04 11:17:13.890000

Last modified

2026-11-04 11:17:13.890000

View original CVE JSON

{
  "id": "CVE-2026-108946",
  "sourceIdentifier": "[email protected]",
  "published": "2026-11-04T11:17:13.890",
  "lastModified": "2026-11-04T11:17:13.890",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDB.\n\n\n\nThe ActiveMQ broker resolves connection, session and consumer state from ids that are user provided and in some scenarios does not validate that they ids are bound to that user. This allows an authenticated client to spoof another user's ids. This allows:\n\n\n\n\n\n  *   an authenticated client consumes from another connection's temporary queue/topic by putting the victim's connection id in its own ConsumerId, bypassing the broker-side ownership check. \n  *  a duplicate ConsumerId registration is only logged, after which the attacker's RemoveInfo or disconnect tears down the victim's live subscription\n  *  a forged MessageAck for the victim's ConsumerId permanently deletes an in-flight, unacknowledged message.\n\n\n\n\n\n\n\n\nThis issue affects Apache ActiveMQ: from 6.0.0 before 6.3.3, before 5.19.12; Apache ActiveMQ KahaDB: from 6.0.0 before 6.3.3, before 5.19.12.\n\n\n\nUsers are recommended to upgrade to version 6.4.0, 6.3.3, or 5.19.12, which fixes the issue."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache ActiveMQ",
          "defaultStatus": "unaffected",
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "packageName": "org.apache.activemq:apache-activemq",
          "packageURL": "pkg:maven/org.apache.activemq/apache-activemq",
          "versions": [
            {
              "version": "6.0.0",
              "lessThan": "6.3.3",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "5.19.12",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Apache Software Foundation",
          "product": "ActiveMQ Broker",
          "defaultStatus": "unaffected",
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "packageName": "org.apache.activemq:activemq-broker",
          "packageURL": "pkg:maven/org.apache.activemq/activemq-broker",
          "versions": [
            {
              "version": "6.0.0",
              "lessThan": "6.3.3",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "5.19.12",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://lists.apache.org/thread/0spj0m846vhw3cjyfmzsy3l8vxh6f5t6",
      "source": "[email protected]"
    }
  ]
}