UBUNTU-CVE-2026-111822: Medium severity ubuntu/activemq vulnerability

Published Nov 4, 2026

Updated

Improper invalidation of cached authorizations vulnerability in Apache ActiveMQ, Apache ActiveMQ Runtime Config. After the runtime configuration plugin removes a principal's write grant on a destination, an authenticated connection opened before the change can keep sending to that destination, including through a new anonymous producer, while fresh connections and new explicit producers are denied. This issue affects Apache ActiveMQ: from 6.0.0 before 6.3.3, before 5.19.12; Apache ActiveMQ Runtime Config: from 6.0.0 before 6.3.3, before 5.19.12. Users are recommended to upgrade to version 6.4.0, 6.3.3 or 5.19.12, which fixes the issue.

Affected Software

7 affected components

ubuntu/activemq*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache ActiveMQ to a version that resolves this vulnerability.
Fixed in 6.4.0
Upgrade
Upgrade Apache ActiveMQ to a version that resolves this vulnerability.
Fixed in 6.3.3
Upgrade
Upgrade Apache ActiveMQ to a version that resolves this vulnerability.
Fixed in 5.19.12
Upgrade
Upgrade Apache ActiveMQ Runtime Config to a version that resolves this vulnerability.
Fixed in 6.4.0
Upgrade
Upgrade Apache ActiveMQ Runtime Config to a version that resolves this vulnerability.
Fixed in 6.3.3
Upgrade
Upgrade Apache ActiveMQ Runtime Config to a version that resolves this vulnerability.
Fixed in 5.19.12

Event History

Nov 4, 2026

CVE Published

via OSV·10:17 AM

Data Sourced

via OSV·10:17 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using Apache ActiveMQ or the Apache ActiveMQ Runtime Config plugin are affected if they run ActiveMQ 6.0.0 through versions before 6.3.3, or a 5.x release before 5.19.12. The issue is relevant where runtime configuration is used to remove a principal's write permission on a destination.

What must an attacker have to continue sending after access is revoked?

The attacker needs an authenticated connection that was opened before the principal's write grant was removed. That existing connection can continue sending to the destination, including by creating a new anonymous producer; newly opened connections and new explicit producers are denied.

How can I determine whether a revoked principal may still have access?

Identify authenticated client connections established before a runtime configuration change that removed write access, and check whether they remain connected. Those pre-existing connections may still be able to send messages until they are no longer active, while connections created after the change should be denied.

What should be done if permissions must be revoked immediately?

Terminate authenticated connections that were established before the write grant was removed, since those connections can retain cached authorization. Upgrade to ActiveMQ 6.4.0, 6.3.3, or 5.19.12 to fix the authorization-cache invalidation issue.

UBUNTU-CVE-2026-111822: Medium severity ubuntu/activemq vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker have to continue sending after access is revoked?

How can I determine whether a revoked principal may still have access?

What should be done if permissions must be revoked immediately?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker have to continue sending after access is revoked?

How can I determine whether a revoked principal may still have access?

What should be done if permissions must be revoked immediately?