Deployments using the runtime configuration plugin to remove a principal's write permission on a destination are exposed if the principal already has an authenticated connection open when the permission is revoked. Fresh connections and newly created explicit producers are denied after the change.
The attacker must already be authenticated and have an open connection established before their write grant is removed. That existing connection can continue sending to the destination, including by creating a new anonymous producer.
Check for authenticated connections that were established before a runtime ACL change removed their write grant. Test or review whether those pre-existing connections can still send to the affected destination; new connections and new explicit producers should be denied.
Upgrade Apache ActiveMQ or Apache ActiveMQ Runtime Config to 6.4.0, 6.3.3, or 5.19.12. The affected ranges are 6.0.0 through versions before 6.3.3, and versions before 5.19.12.