Improper Authorization in ActiveMQ - CVE-2026-61487
Published: August 24, 2026
Vulnerability identifier: #VU144757
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-61487
CWE-ID: CWE-285
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to bypass authorization and publish messages to unauthorized destinations.
The vulnerability exists due to improper authorization in ActiveMQ destination authorization handling when sending to a temporary composite destination whose physical name is a comma-separated composite of real queues. A remote user can send a message to a crafted temporary composite destination to bypass authorization and publish messages to unauthorized destinations.
The issue affects per-destination write ACL enforcement for temporary composite destinations.
Affected software
ActiveMQ
openEuler
activemq
activemq-javadoc
openEuler
activemq
activemq-javadoc
How to mitigate CVE-2026-61487
Install security update from vendor's website.
ActiveMQ - addressed in versions 6.2.0, 6.2.8
activemq - update to 5.19.9-1
activemq-javadoc - update to 5.19.9-1
activemq - update to 5.19.9-1
activemq-javadoc - update to 5.19.9-1