CVE-2026-61487 in ActiveMQ
Summary
by MITRE • 07/28/2026
Improper Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ.
An authenticated low-privilege user can bypass a per-destination write ACL by sending to an ActiveMQ temporary composite destination whose physical name is a comma-separated composite of real queues. This allows publishing messages to any of the destinations in the list without proper write ACL permissions because the authorization check is bypassed due to the composite destination being marked as temporary. This issue affects Apache ActiveMQ Broker: before 5.19.9, from 6.0.0 before 6.2.8; Apache ActiveMQ All: before 5.19.9, from 6.0.0 before 6.2.8; Apache ActiveMQ: before 5.19.9, from 6.0.0 before 6.2.8.
Users are recommended to upgrade to version 5.19.9, 6.2.8 or 6.3.0, which fixes the issue.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/28/2026
The vulnerability described represents a critical improper authorization flaw within Apache ActiveMQ messaging systems that undermines fundamental security controls designed to protect message destinations. This weakness specifically affects the access control list (ACL) mechanisms that govern write permissions for message queues and topics, creating a pathway for authenticated users with minimal privileges to bypass intended security boundaries. The issue manifests through a sophisticated manipulation of destination naming conventions that exploits the system's temporary destination handling logic.
The technical exploitation occurs when a low-privilege user crafts a composite destination name using comma-separated queue references within a temporary destination structure. This composite destination pattern allows the system to process multiple physical queues simultaneously while maintaining the temporary destination flag, which is crucial for the bypass mechanism. The authorization subsystem performs checks against the temporary destination designation rather than examining the individual constituent destinations within the composite structure. This design flaw stems from a failure in the ACL evaluation logic where temporary destinations receive special treatment that does not properly validate write permissions for all underlying components.
From an operational standpoint, this vulnerability enables significant damage potential as attackers can publish messages to any queue within the comma-separated list without possessing proper write permissions for those specific destinations. The impact extends beyond simple message injection since it allows for arbitrary data propagation across multiple system components, potentially facilitating information disclosure, service disruption, or even lateral movement within environments where ActiveMQ serves as a communication backbone. The vulnerability affects multiple product variants including the standalone broker, the all-in-one distribution, and the core messaging platform, indicating a widespread issue that requires comprehensive remediation across various deployment scenarios.
The security implications align with CWE-285, which addresses improper authorization in software systems, and demonstrates characteristics consistent with ATT&CK technique T1078.004 related to valid accounts and T1566.001 concerning spearphishing attachments. The vulnerability exploits the trust model inherent in authenticated sessions while undermining the principle of least privilege that should govern access controls. Organizations running affected versions face risks including unauthorized message routing, potential data exfiltration through message content manipulation, and disruption of message flow integrity across their messaging infrastructure.
Mitigation strategies require immediate deployment of patched versions 5.19.9, 6.2.8, or 6.3.0 as recommended by the vendor, which implement proper ACL validation for composite destinations regardless of their temporary designation status. Additionally, organizations should review and tighten existing ACL configurations to minimize the impact of potential exploitation attempts. Network segmentation and monitoring of unusual destination creation patterns can provide additional defensive layers. System administrators should also consider implementing stricter access controls for message producers and conducting regular audits of destination permissions to ensure that the principle of least privilege is maintained across all messaging components within their infrastructure.