CVE-2026-61487
Awaiting Analysis Awaiting Analysis - Queue

Improper Authorization in Apache ActiveMQ

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: Apache Software Foundation

Description
Improper Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. An authenticated low-privilege user can bypass a per-destination write ACL by sending to an ActiveMQ temporary composite destination whose physical name is a comma-separated composite of real queues. This allows publishing messages to any of the destinations in the list without proper write ACL permissions because the authorization check is bypassed due to the composite destination being marked as temporary. This issue affects Apache ActiveMQ Broker: before 5.19.9, from 6.0.0 before 6.2.8; Apache ActiveMQ All: before 5.19.9, from 6.0.0 before 6.2.8; Apache ActiveMQ: before 5.19.9, from 6.0.0 before 6.2.8. Users are recommended to upgrade to version 5.19.9, 6.2.8 or 6.3.0, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-28
Last Modified
2026-07-28
Generated
2026-07-28
AI Q&A
2026-07-28
EPSS Evaluated
N/A
NVD
CVE-2026-61487
EUVD
EUVD-2026-49847

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
apache activemq_broker From 6.0.0 (inc) to 6.2.8 (exc)
apache activemq_all From 6.0.0 (inc) to 6.2.8 (exc)
apache activemq From 6.0.0 (inc) to 6.2.8 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an improper authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, and Apache ActiveMQ. An authenticated low-privilege user can bypass per-destination write ACLs by sending messages to a temporary composite destination. The exploit uses a physical name made of comma-separated real queues, which bypasses authorization checks because the composite destination is treated as temporary. This allows publishing messages to any destination in the list without proper write permissions.

Detection Guidance

Detecting this vulnerability requires checking Apache ActiveMQ versions and monitoring for unauthorized message publishing attempts. Check your ActiveMQ version with: 'activemq --version' or inspect the broker logs for suspicious composite destination usage. Look for log entries showing messages sent to temporary composite destinations with comma-separated queue names.

Impact Analysis

An attacker with low privileges could publish unauthorized messages to protected queues or topics. This may lead to data leaks, message tampering, or denial of service if malicious messages disrupt system operations. Systems relying on ACLs for message routing are particularly at risk.

Compliance Impact

This vulnerability could violate compliance requirements that mandate strict access controls for sensitive data, such as GDPR's data integrity principles or HIPAA's access controls for protected health information. Unauthorized message access may result in data breaches or unauthorized modifications.

Mitigation Strategies

Immediately upgrade Apache ActiveMQ to version 5.19.9, 6.2.8, or 6.3.0. If upgrading is not immediately possible, restrict network access to the ActiveMQ broker and disable low-privilege user access until patched. Review and enforce strict ACL policies on all destinations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-61487. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart