Missing Authorization in ActiveMQ - CVE-2026-54475

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU136625

Missing Authorization in ActiveMQ - CVE-2026-54475

Published: July 1, 2026


Vulnerability identifier: #VU136625
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-54475
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote user to consume messages from another connection's temporary destination.

The vulnerability exists due to improper access control in temporary destination ownership enforcement when handling access to temporary destinations. A remote user can use a different connection to consume from another connection's temporary destination to consume messages from another connection's temporary destination.

The isolation of temporary destinations is only checked in the client.


Affected software

ActiveMQ
Jazz for Service Management

How to mitigate CVE-2026-54475

Install security update from vendor's website.

ActiveMQ - addressed in versions 5.19.8, 6.2.7
Jazz for Service Management - update to 1.1.3.27 ifix 0002

External References

Related Security Bulletins