CVE-2026-111822

Full vulnerability record from the local CVENow database.

Description

Improper invalidation of cached authorizations vulnerability in Apache ActiveMQ, Apache ActiveMQ Runtime Config. After the runtime configuration plugin removes a principal's write grant on a destination, an authenticated connection opened before the change can keep sending to that destination, including through a new anonymous producer, while fresh connections and new explicit producers are denied. This issue affects Apache ActiveMQ: from 6.0.0 before 6.3.3, before 5.19.12; Apache ActiveMQ Runtime Config: from 6.0.0 before 6.3.3, before 5.19.12. Users are recommended to upgrade to version 6.4.0, 6.3.3 or 5.19.12, which fixes the issue.

Severity

Not scored

CVSS score

Not available

Vulnerability status

Received

Source identifier

[email protected]

Published

2026-11-04 10:17:25.500000

Last modified

2026-11-04 10:17:25.500000

View original CVE JSON

{
  "id": "CVE-2026-111822",
  "sourceIdentifier": "[email protected]",
  "published": "2026-11-04T10:17:25.500",
  "lastModified": "2026-11-04T10:17:25.500",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper invalidation of cached authorizations vulnerability in Apache ActiveMQ, Apache ActiveMQ Runtime Config.\n\n\n\nAfter the runtime configuration plugin removes a principal's write grant on a destination, an authenticated connection opened before the change can keep sending to that destination, including through a new anonymous producer, while fresh connections and new explicit producers are denied.\n\n\n\nThis issue affects Apache ActiveMQ: from 6.0.0 before 6.3.3, before 5.19.12; Apache ActiveMQ Runtime Config: from 6.0.0 before 6.3.3, before 5.19.12.\n\n\n\nUsers are recommended to upgrade to version 6.4.0, 6.3.3 or 5.19.12, which fixes the issue."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache ActiveMQ",
          "defaultStatus": "unaffected",
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "packageName": "org.apache.activemq:apache-activemq",
          "packageURL": "pkg:maven/org.apache.activemq/apache-activemq",
          "versions": [
            {
              "version": "6.0.0",
              "lessThan": "6.3.3",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "5.19.12",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache ActiveMQ Runtime Config",
          "defaultStatus": "unaffected",
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "packageName": "org.apache.activemq:activemq-runtime-config",
          "packageURL": "pkg:maven/org.apache.activemq/activemq-runtime-config",
          "versions": [
            {
              "version": "6.0.0",
              "lessThan": "6.3.3",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "5.19.12",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "references": [
    {
      "url": "https://lists.apache.org/thread/b5gop0kwsm4sr1pgdrfcd14q8hx942j5",
      "source": "[email protected]"
    }
  ]
}