Executive brief
Apache ActiveMQ, a widely used open-source message broker for handling communication between different applications, contains a security flaw in how it verifies user permissions. An attacker who already has basic login credentials to the system can delete message destinations (queues or topics) that they should not have permission to modify. This could lead to service disruptions or data loss by removing the channels through which business applications communicate.
Technical details
An improper authorization vulnerability (CWE-285) exists in Apache ActiveMQ's destination removal workflow. The server fails to correctly validate permissions when an authenticated connection attempts to remove existing destinations (queues or topics). A remote attacker with low-privileged credentials can exploit this flaw to delete destinations, leading to a partial loss of availability. The issue is resolved in versions 5.19.7 and 6.2.6.
Affected products
- Apache ActiveMQ Broker < 5.19.7, 6.0.0 to < 6.2.6
- Apache ActiveMQ All < 5.19.7, 6.0.0 to < 6.2.6
- Apache ActiveMQ < 5.19.7, 6.0.0 to < 6.2.6
Timeline
- 2026-05-31: disclosed: Initial disclosure on oss-security mailing list
- 2026-06-01: advisory: GitHub and NVD advisories published
- 2026-07-09: other: GitHub advisory reviewed and updated