Vulnerability-Lookup

CVE-2026-46605 (GCVE-0-2026-46605)

Vulnerability from cvelistv5 – Published: 2026-06-01 07:21 – Updated: 2026-06-01 14:44

Title

Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incomplete authorization during destination removal

Summary

Incomplete authorization by Apache ActiveMQ server before versions v6.2.6 and v5.19.7 allows authenticated connections to remove existing destinations with proper permissions. This issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ All: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6. Users are recommended to upgrade to version v6.2.6 or v5.19.7, which fixes the issue.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-285 - Improper Authorization

Assigner

apache

References

2 references

URL	Tags
https://lists.apache.org/thread/l4lxgr2s73g9pb218…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/0…

Impacted products

3 products

Vendor	Product	Version
Apache Software Foundation	Apache ActiveMQ Broker	Affected: 0 , < 5.19.7 (semver) Affected: 6.0.0 , < 6.2.6 (semver)
Apache Software Foundation	Apache ActiveMQ All	Affected: 0 , < 5.19.7 (semver) Affected: 6.0.0 , < 6.2.6 (semver)
Apache Software Foundation	Apache ActiveMQ	Affected: 0 , < 5.19.7 (semver) Affected: 6.0.0 , < 6.2.6 (semver)

Credits

Leon Johnson (github: lokerxx)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-06-01T07:48:00.286Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/05/31/20"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 4.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-46605",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-01T14:44:45.455019Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-01T14:44:50.457Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.activemq:activemq-broker",
          "product": "Apache ActiveMQ Broker",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "5.19.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "6.2.6",
              "status": "affected",
              "version": "6.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.activemq:activemq-all",
          "product": "Apache ActiveMQ All",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "5.19.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "6.2.6",
              "status": "affected",
              "version": "6.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.activemq:apache-activemq",
          "product": "Apache ActiveMQ",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "5.19.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "6.2.6",
              "status": "affected",
              "version": "6.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Leon Johnson (github: lokerxx)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIncomplete authorization by Apache ActiveMQ server before versions v6.2.6 and v5.19.7 allows authenticated connections to remove existing destinations with proper permissions.\u003c/p\u003e\u003cp\u003eThis issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ All: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version v6.2.6 or v5.19.7, which fixes the issue.\u003c/p\u003e"
            }
          ],
          "value": "Incomplete authorization by Apache ActiveMQ server before versions v6.2.6 and v5.19.7 allows authenticated connections to remove existing destinations with proper permissions.\n\nThis issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ All: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6.\n\nUsers are recommended to upgrade to version v6.2.6 or v5.19.7, which fixes the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "moderate"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285 Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-01T07:21:13.148Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/l4lxgr2s73g9pb218f180psfyskf8ldm"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incomplete authorization during destination removal",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-46605",
    "datePublished": "2026-06-01T07:21:13.148Z",
    "dateReserved": "2026-05-15T18:20:10.111Z",
    "dateUpdated": "2026-06-01T14:44:50.457Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-46605",
      "date": "2026-06-02",
      "epss": "0.00058",
      "percentile": "0.18247"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-46605\",\"sourceIdentifier\":\"security@apache.org\",\"published\":\"2026-06-01T09:16:19.827\",\"lastModified\":\"2026-06-01T17:07:51.933\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Incomplete authorization by Apache ActiveMQ server before versions v6.2.6 and v5.19.7 allows authenticated connections to remove existing destinations with proper permissions.\\n\\nThis issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ All: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6.\\n\\nUsers are recommended to upgrade to version v6.2.6 or v5.19.7, which fixes the issue.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L\",\"baseScore\":4.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":2.8,\"impactScore\":1.4}]},\"weaknesses\":[{\"source\":\"security@apache.org\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-285\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"5.19.7\",\"matchCriteriaId\":\"793E68E6-9024-4518-B062-42B2DE5BB555\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.0.0\",\"versionEndExcluding\":\"6.2.6\",\"matchCriteriaId\":\"FFF44DB9-1850-4B5F-AD0F-55CB5219AB22\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:activemq_broker:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"5.19.7\",\"matchCriteriaId\":\"FE27E832-0E65-4D05-A2EE-271152799E96\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:activemq_broker:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.0.0\",\"versionEndExcluding\":\"6.2.6\",\"matchCriteriaId\":\"94F0DB6E-BEF4-4BEB-92F5-3A7B65172CC2\"}]}]}],\"references\":[{\"url\":\"https://lists.apache.org/thread/l4lxgr2s73g9pb218f180psfyskf8ldm\",\"source\":\"security@apache.org\",\"tags\":[\"Mailing List\",\"Vendor Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2026/05/31/20\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"http://www.openwall.com/lists/oss-security/2026/05/31/20\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2026-06-01T07:48:00.286Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 4.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-46605\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-01T14:44:45.455019Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-01T14:44:38.368Z\"}}], \"cna\": {\"title\": \"Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incomplete authorization during destination removal\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Leon Johnson (github: lokerxx)\"}], \"metrics\": [{\"other\": {\"type\": \"Textual description of severity\", \"content\": {\"text\": \"moderate\"}}}], \"affected\": [{\"vendor\": \"Apache Software Foundation\", \"product\": \"Apache ActiveMQ Broker\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"5.19.7\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"6.0.0\", \"lessThan\": \"6.2.6\", \"versionType\": \"semver\"}], \"packageName\": \"org.apache.activemq:activemq-broker\", \"collectionURL\": \"https://repo.maven.apache.org/maven2\", \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Apache Software Foundation\", \"product\": \"Apache ActiveMQ All\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"5.19.7\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"6.0.0\", \"lessThan\": \"6.2.6\", \"versionType\": \"semver\"}], \"packageName\": \"org.apache.activemq:activemq-all\", \"collectionURL\": \"https://repo.maven.apache.org/maven2\", \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Apache Software Foundation\", \"product\": \"Apache ActiveMQ\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"5.19.7\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"6.0.0\", \"lessThan\": \"6.2.6\", \"versionType\": \"semver\"}], \"packageName\": \"org.apache.activemq:apache-activemq\", \"collectionURL\": \"https://repo.maven.apache.org/maven2\", \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://lists.apache.org/thread/l4lxgr2s73g9pb218f180psfyskf8ldm\", \"tags\": [\"vendor-advisory\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Incomplete authorization by Apache ActiveMQ server before versions v6.2.6 and v5.19.7 allows authenticated connections to remove existing destinations with proper permissions.\\n\\nThis issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ All: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6.\\n\\nUsers are recommended to upgrade to version v6.2.6 or v5.19.7, which fixes the issue.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eIncomplete authorization by Apache ActiveMQ server before versions v6.2.6 and v5.19.7 allows authenticated connections to remove existing destinations with proper permissions.\u003c/p\u003e\u003cp\u003eThis issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ All: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version v6.2.6 or v5.19.7, which fixes the issue.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-285\", \"description\": \"CWE-285 Improper Authorization\"}]}], \"providerMetadata\": {\"orgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"shortName\": \"apache\", \"dateUpdated\": \"2026-06-01T07:21:13.148Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-46605\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-06-01T14:44:50.457Z\", \"dateReserved\": \"2026-05-15T18:20:10.111Z\", \"assignerOrgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"datePublished\": \"2026-06-01T07:21:13.148Z\", \"assignerShortName\": \"apache\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-46605

Vulnerability from fkie_nvd - Published: 2026-06-01 09:16 - Updated: 2026-06-01 17:07

Severity

4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Summary

References

	URL	Tags
	security@apache.org	https://lists.apache.org/thread/l4lxgr2s73g9pb218f180psfyskf8ldm	Mailing List, Vendor Advisory
	af854a3a-2127-422b-91ae-364da2661108	http://www.openwall.com/lists/oss-security/2026/05/31/20	Mailing List, Third Party Advisory

Impacted products

Vendor	Product	Version
apache	activemq	*
apache	activemq	*
apache	activemq_broker	*
apache	activemq_broker	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "793E68E6-9024-4518-B062-42B2DE5BB555",
              "versionEndExcluding": "5.19.7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "FFF44DB9-1850-4B5F-AD0F-55CB5219AB22",
              "versionEndExcluding": "6.2.6",
              "versionStartIncluding": "6.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:activemq_broker:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "FE27E832-0E65-4D05-A2EE-271152799E96",
              "versionEndExcluding": "5.19.7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:activemq_broker:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "94F0DB6E-BEF4-4BEB-92F5-3A7B65172CC2",
              "versionEndExcluding": "6.2.6",
              "versionStartIncluding": "6.0.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Incomplete authorization by Apache ActiveMQ server before versions v6.2.6 and v5.19.7 allows authenticated connections to remove existing destinations with proper permissions.\n\nThis issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ All: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6.\n\nUsers are recommended to upgrade to version v6.2.6 or v5.19.7, which fixes the issue."
    }
  ],
  "id": "CVE-2026-46605",
  "lastModified": "2026-06-01T17:07:51.933",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-06-01T09:16:19.827",
  "references": [
    {
      "source": "security@apache.org",
      "tags": [
        "Mailing List",
        "Vendor Advisory"
      ],
      "url": "https://lists.apache.org/thread/l4lxgr2s73g9pb218f180psfyskf8ldm"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2026/05/31/20"
    }
  ],
  "sourceIdentifier": "security@apache.org",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-285"
        }
      ],
      "source": "security@apache.org",
      "type": "Secondary"
    }
  ]
}

GHSA-CPW7-G3P5-QRFQ

Vulnerability from github – Published: 2026-06-01 09:31 – Updated: 2026-06-01 15:30

Details

Incomplete authorization by Apache ActiveMQ server before versions v6.2.6 and v5.19.7 allows authenticated connections to remove existing destinations with proper permissions.

This issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ All: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6.

Users are recommended to upgrade to version v6.2.6 or v5.19.7, which fixes the issue.

Severity

4.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-46605"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-285"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-01T09:16:19Z",
    "severity": "MODERATE"
  },
  "details": "Incomplete authorization by Apache ActiveMQ server before versions v6.2.6 and v5.19.7 allows authenticated connections to remove existing destinations with proper permissions.\n\nThis issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ All: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6.\n\nUsers are recommended to upgrade to version v6.2.6 or v5.19.7, which fixes the issue.",
  "id": "GHSA-cpw7-g3p5-qrfq",
  "modified": "2026-06-01T15:30:40Z",
  "published": "2026-06-01T09:31:15Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46605"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread/l4lxgr2s73g9pb218f180psfyskf8ldm"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2026/05/31/20"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ]
}

WID-SEC-W-2026-1741

Vulnerability from csaf_certbund - Published: 2026-05-31 22:00 - Updated: 2026-06-01 22:00

Summary

Apache ActiveMQ: Mehrere Schwachstellen

Severity

Hoch

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: Apache ActiveMQ ist ein Open Source Message Broker, der den Transport von Nachrichten zwischen verschiedenen Programmen bewerkstelligt.

Angriff: Ein Angreifer kann mehrere Schwachstellen in Apache ActiveMQ ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen, Informationen offenzulegen, seine Rechte zu erweitern, Daten zu manipulieren und Code auszuführen.

Betroffene Betriebssysteme: - Linux - Sonstiges - UNIX - Windows

CVE-2026-42253

Affected products

Known affected 2 products

Product	Identifier	Version	Remediation
Apache ActiveMQ <6.2.6 Apache / ActiveMQ		<6.2.6
Apache ActiveMQ <5.19.7 Apache / ActiveMQ		<5.19.7

CVE-2026-42588

Affected products

Known affected 2 products

Product	Identifier	Version	Remediation
Apache ActiveMQ <6.2.6 Apache / ActiveMQ		<6.2.6
Apache ActiveMQ <5.19.7 Apache / ActiveMQ		<5.19.7

CVE-2026-45505

Affected products

Known affected 2 products

Product	Identifier	Version	Remediation
Apache ActiveMQ <6.2.6 Apache / ActiveMQ		<6.2.6
Apache ActiveMQ <5.19.7 Apache / ActiveMQ		<5.19.7

CVE-2026-46605

Affected products

Known affected 2 products

Product	Identifier	Version	Remediation
Apache ActiveMQ <6.2.6 Apache / ActiveMQ		<6.2.6
Apache ActiveMQ <5.19.7 Apache / ActiveMQ		<5.19.7

CVE-2026-49157

Affected products

Known affected 2 products

Product	Identifier	Version	Remediation
Apache ActiveMQ <6.2.6 Apache / ActiveMQ		<6.2.6
Apache ActiveMQ <5.19.7 Apache / ActiveMQ		<5.19.7

CVE-2026-49270

Affected products

Known affected 2 products

Product	Identifier	Version	Remediation
Apache ActiveMQ <6.2.6 Apache / ActiveMQ		<6.2.6
Apache ActiveMQ <5.19.7 Apache / ActiveMQ		<5.19.7

References

9 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://activemq.apache.org/security-advisories.d…	external
https://activemq.apache.org/security-advisories.d…	external
https://activemq.apache.org/security-advisories.d…	external
https://activemq.apache.org/security-advisories.d…	external
https://activemq.apache.org/security-advisories.d…	external
https://activemq.apache.org/security-advisories.d…	external
https://activemq.apache.org/security-advisories.data	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Apache ActiveMQ ist ein Open Source Message Broker, der den Transport von Nachrichten zwischen verschiedenen Programmen bewerkstelligt.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer kann mehrere Schwachstellen in Apache ActiveMQ ausnutzen, um einen Cross-Site Scripting Angriff durchzuf\u00fchren, Informationen offenzulegen, seine Rechte zu erweitern, Daten zu manipulieren und Code auszuf\u00fchren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- Sonstiges\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-1741 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1741.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-1741 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-1741"
      },
      {
        "category": "external",
        "summary": "Apache ActiveMQ Security Advisory vom 2026-05-31",
        "url": "https://activemq.apache.org/security-advisories.data/CVE-2026-42253-announcement.txt"
      },
      {
        "category": "external",
        "summary": "Apache ActiveMQ Security Advisory vom 2026-05-31",
        "url": "https://activemq.apache.org/security-advisories.data/CVE-2026-42588-announcement.txt"
      },
      {
        "category": "external",
        "summary": "Apache ActiveMQ Security Advisory vom 2026-05-31",
        "url": "https://activemq.apache.org/security-advisories.data/CVE-2026-45505-announcement.txt"
      },
      {
        "category": "external",
        "summary": "Apache ActiveMQ Security Advisory vom 2026-05-31",
        "url": "https://activemq.apache.org/security-advisories.data/CVE-2026-46605-announcement.txt"
      },
      {
        "category": "external",
        "summary": "Apache ActiveMQ Security Advisory vom 2026-05-31",
        "url": "https://activemq.apache.org/security-advisories.data/CVE-2026-49157-announcement.txt"
      },
      {
        "category": "external",
        "summary": "Apache ActiveMQ Security Advisory vom 2026-05-31",
        "url": "https://activemq.apache.org/security-advisories.data/CVE-2026-49270-announcement.txt"
      },
      {
        "category": "external",
        "summary": "Apache ActiveMQ Security Advisory vom 2026-05-31",
        "url": "https://activemq.apache.org/security-advisories.data"
      }
    ],
    "source_lang": "en-US",
    "title": "Apache ActiveMQ: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2026-06-01T22:00:00.000+00:00",
      "generator": {
        "date": "2026-06-02T05:12:27.283+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.6.0"
        }
      },
      "id": "WID-SEC-W-2026-1741",
      "initial_release_date": "2026-05-31T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-05-31T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2026-06-01T22:00:00.000+00:00",
          "number": "2",
          "summary": "Link zu CVE-2026-46605 korrigiert"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c5.19.7",
                "product": {
                  "name": "Apache ActiveMQ \u003c5.19.7",
                  "product_id": "T054887"
                }
              },
              {
                "category": "product_version",
                "name": "5.19.7",
                "product": {
                  "name": "Apache ActiveMQ 5.19.7",
                  "product_id": "T054887-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:apache:activemq:5.19.7"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c6.2.6",
                "product": {
                  "name": "Apache ActiveMQ \u003c6.2.6",
                  "product_id": "T054888"
                }
              },
              {
                "category": "product_version",
                "name": "6.2.6",
                "product": {
                  "name": "Apache ActiveMQ 6.2.6",
                  "product_id": "T054888-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:apache:activemq:6.2.6"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "ActiveMQ"
          }
        ],
        "category": "vendor",
        "name": "Apache"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-42253",
      "product_status": {
        "known_affected": [
          "T054888",
          "T054887"
        ]
      },
      "release_date": "2026-05-31T22:00:00.000+00:00",
      "title": "CVE-2026-42253"
    },
    {
      "cve": "CVE-2026-42588",
      "product_status": {
        "known_affected": [
          "T054888",
          "T054887"
        ]
      },
      "release_date": "2026-05-31T22:00:00.000+00:00",
      "title": "CVE-2026-42588"
    },
    {
      "cve": "CVE-2026-45505",
      "product_status": {
        "known_affected": [
          "T054888",
          "T054887"
        ]
      },
      "release_date": "2026-05-31T22:00:00.000+00:00",
      "title": "CVE-2026-45505"
    },
    {
      "cve": "CVE-2026-46605",
      "product_status": {
        "known_affected": [
          "T054888",
          "T054887"
        ]
      },
      "release_date": "2026-05-31T22:00:00.000+00:00",
      "title": "CVE-2026-46605"
    },
    {
      "cve": "CVE-2026-49157",
      "product_status": {
        "known_affected": [
          "T054888",
          "T054887"
        ]
      },
      "release_date": "2026-05-31T22:00:00.000+00:00",
      "title": "CVE-2026-49157"
    },
    {
      "cve": "CVE-2026-49270",
      "product_status": {
        "known_affected": [
          "T054888",
          "T054887"
        ]
      },
      "release_date": "2026-05-31T22:00:00.000+00:00",
      "title": "CVE-2026-49270"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-46605 (GCVE-0-2026-46605)

FKIE_CVE-2026-46605

GHSA-CPW7-G3P5-QRFQ

WID-SEC-W-2026-1741

Tags

Sightings

Nomenclature