CVE-2026-111822: Apache ActiveMQ, Apache ActiveMQ Runtime Config: ActiveMQ retains write access after live ACL revocation
Improper invalidation of cached authorizations vulnerability in Apache ActiveMQ, Apache ActiveMQ Runtime Config.
After the runtime configuration plugin removes a principal's write grant on a destination, an authenticated connection opened before the change can keep sending to that destination, including through a new anonymous producer, while fresh connections and new explicit producers are denied.
This issue affects Apache ActiveMQ: from 6.0.0 before 6.3.3, before 5.19.12; Apache ActiveMQ Runtime Config: from 6.0.0 before 6.3.3, before 5.19.12.
Users are recommended to upgrade to version 6.4.0, 6.3.3 or 5.19.12, which fixes the issue.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache ActiveMQto a version that resolves this vulnerability.Fixed in 6.4.0 - Upgrade
Upgrade
Apache ActiveMQto a version that resolves this vulnerability.Fixed in 6.3.3 - Upgrade
Upgrade
Apache ActiveMQto a version that resolves this vulnerability.Fixed in 5.19.12
Event History
Frequently Asked Questions
What conditions are required for exploitation?
An attacker needs an authenticated connection that was opened before the runtime configuration plugin removes that principal's write permission on a destination. That pre-existing connection can continue sending after revocation, including by creating a new anonymous producer.
Which clients are denied after the write grant is revoked?
Fresh connections and newly created explicit producers are denied after the revocation. The issue is limited to authorization state retained by an already-open authenticated connection.
How can I determine whether a deployment may be affected?
Review whether Apache ActiveMQ Runtime Config is used to revoke destination write permissions while client connections remain open. Deployments running Apache ActiveMQ or Apache ActiveMQ Runtime Config from 6.0.0 before 6.3.3, or versions before 5.19.12, may be affected.
What remediation is provided?
Upgrade to Apache ActiveMQ version 6.4.0, 6.3.3, or 5.19.12. The provided information does not identify an alternative mitigation when upgrading cannot be performed immediately.