CVE-2026-111822 in ActiveMQ
Summary
by MITRE • 11/04/2026
Improper invalidation of cached authorizations vulnerability in Apache ActiveMQ, Apache ActiveMQ Runtime Config.
After the runtime configuration plugin removes a principal's write grant on a destination, an authenticated connection opened before the change can keep sending to that destination, including through a new anonymous producer, while fresh connections and new explicit producers are denied.
This issue affects Apache ActiveMQ: from 6.0.0 before 6.3.3, before 5.19.12; Apache ActiveMQ Runtime Config: from 6.0.0 before 6.3.3, before 5.19.12.
Users are recommended to upgrade to version 6.4.0, 6.3.3 or 5.19.12, which fixes the issue.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/04/2026
The vulnerability identified in Apache ActiveMQ and its Runtime Config plugin represents a critical failure in session-based access control enforcement, specifically concerning the invalidation of cached authorizations. This flaw allows authenticated connections that were established prior to a security policy change to retain write privileges on specific destinations even after those permissions have been explicitly revoked by an administrator. The core technical issue lies in how the broker handles state transitions for existing sessions versus new ones. When the runtime configuration plugin removes a principal's write grant, it correctly updates the central authorization cache and enforces these restrictions for fresh connections or newly created explicit producers within active sessions. However, legacy authenticated connections that were already open at the time of the policy update fail to refresh their local permission state effectively. This creates a discrepancy where the broker’s global security model is updated, but individual session contexts continue to operate under outdated authorization assumptions, allowing them to bypass intended restrictions.
From an operational perspective, this vulnerability poses significant risks related to data integrity and confidentiality. An attacker or malicious insider with access to an existing authenticated connection could exploit this lag in permission invalidation to send unauthorized messages to protected destinations. This is particularly dangerous because the exploitation does not require re-authentication or complex session hijacking techniques; it simply requires maintaining an active connection while an administrator revokes permissions elsewhere. The ability to continue sending data through a new anonymous producer within that same flawed context further exacerbates the risk, as it may allow traffic to be masked or routed in ways that evade standard monitoring tools expecting only authorized sources. This behavior undermines the principle of least privilege and can lead to unauthorized data exfiltration, injection of malicious payloads into secure queues, or disruption of services relying on strict message filtering rules.
This vulnerability aligns closely with CWE-284 Improper Access Control, specifically reflecting failures in enforcing access control restrictions after state changes occur within a session lifecycle. It also maps to the MITRE ATT&CK technique T1078 Valid Accounts, as it involves leveraging legitimate credentials that have not been properly invalidated by administrative actions. The flaw highlights a common challenge in distributed messaging systems where connection pooling and long-lived sessions can outlive policy updates if state synchronization mechanisms are insufficiently robust. Security architects must recognize that simply updating configuration files or invoking admin APIs to revoke permissions is not enough; the underlying broker implementation must ensure immediate propagation of these changes across all active session contexts, including those utilizing anonymous producers within authenticated streams.
To mitigate this risk, organizations running affected versions of Apache ActiveMQ from 6.0.0 up to but not including 6.3.3 or 5.19.12 are strongly advised to upgrade immediately to version 6.4.0, 6.3.3, or 5.19.12, where the authorization cache invalidation logic has been corrected. In environments where immediate upgrading is not feasible, temporary mitigations should include actively closing and reopening all authenticated connections after any significant security policy change to force a refresh of session-level permissions. Additionally, implementing strict monitoring for unexpected message flows on restricted destinations can help detect exploitation attempts during the window between permission revocation and connection closure. Regular audits of active sessions against current authorization policies are also recommended to ensure no stale privileges persist in long-running application connections.