CVE-2026-46605
Incomplete authorization by Apache ActiveMQ server before versions v6.2.6 and v5.19.7 allows authenticated connections to remove existing destinations with proper permissions. This issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ All: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6. Users are recommended to upgrade to version v6.2.6 or v5.19.7, which fixes the issue.
- Score
- CVSS 3.1 4.3 Medium
- Status
- Analyzed - security@apache.org
- Published
- 2026-06-01
- Last modified
- 2026-06-01
- Weaknesses
- CWE-285
Affected products
- Activemq (Apache)
- Activemq Broker (Apache)
- Apache Activemq (Apache Software Foundation)
- Apache Activemq All (Apache Software Foundation)
- Apache Activemq Broker (Apache Software Foundation)
References
- https://lists.apache.org/thread/l4lxgr2s73g9pb218f180psfyskf8ldm
- http://www.openwall.com/lists/oss-security/2026/05/31/20
