CVE-2026-108500: Apache ActiveMQ: LDAPAuthorizationMap allows authorization bypass via DN injection
Input validation vulnerability in Apache ActiveMQ configured to use the LDAPAuthorizationMapPlugin allows an authenticated attacker to create or address a destination with a crafted name containing LDAP DN special characters (such as comma, plus, equals, backslash) can manipulate the LDAP search base used for ACL lookups.
This issue affects Apache ActiveMQ: from 6.3.0 before 6.3.3, from 5.19.0 before 5.19.12.
Users are recommended to upgrade to version 6.4.0, 6.3.3 or 5.19.12, which fixes the issue.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache ActiveMQto a version that resolves this vulnerability.Fixed in 6.4.0 - Upgrade
Upgrade
Apache ActiveMQto a version that resolves this vulnerability.Fixed in 6.3.3 - Upgrade
Upgrade
Apache ActiveMQto a version that resolves this vulnerability.Fixed in 5.19.12
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Apache ActiveMQ deployments using the LDAPAuthorizationMapPlugin are affected if they run versions 6.3.0 through before 6.3.3, or 5.19.0 through before 5.19.12. The issue is tied to LDAP-backed authorization ACL lookups.
What does an attacker need to exploit the vulnerability?
The attacker must be authenticated and able to create or address a destination with a crafted name containing LDAP DN special characters, such as commas, plus signs, equals signs, or backslashes.
What is the impact of a successful exploit?
A crafted destination name can manipulate the LDAP search base used for ACL lookups, allowing an authorization bypass.
What should be done to remediate the issue?
Upgrade to Apache ActiveMQ 6.4.0, 6.3.3, or 5.19.12. These versions fix the input validation issue.