CVE-2026-54475
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk44th percentile — higher than 44% of all known CVEs
Summary
A missing authorization vulnerability was found in Apache ActiveMQ for temporary destinations. Temporary destinations are expected to be isolated to the connection that created them, but the isolation is only checked on the client side, allowing a different connection to consume from another connection's temporary destination.
Risk Assessment
The risk involves unauthorized access to temporary destinations by other connections, potentially leading to data leakage or message integrity compromise.
Recommendation
It is recommended to upgrade Apache ActiveMQ to version 6.2.7 or later, which includes a fix for this vulnerability.
Original NVD description (English source)
Missing Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. Apache ActiveMQ Classic temporary destinations are expected to be isolated to the connection that created them. The isolation can be broken as this is only checked in the client, allowing a different connection to consume from another connection's temporary destination. This issue affects Apache ActiveMQ Broker: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7. Users are recommended to upgrade to version 6.2.7, which fixes the issue.