CVE-2026-111822
Apache ActiveMQ, Apache ActiveMQ Runtime Config: ActiveMQ retains write access after live ACL revocation
Improper invalidation of cached authorizations vulnerability in Apache ActiveMQ, Apache ActiveMQ Runtime Config.
After the runtime configuration plugin removes a principal's write grant on a destination, an authenticated connection opened before the change can keep sending to that destination, including through a new anonymous producer, while fresh connections and new explicit producers are denied.
This issue affects Apache ActiveMQ: from 6.0.0 before 6.3.3, before 5.19.12; Apache ActiveMQ Runtime Config: from 6.0.0 before 6.3.3, before 5.19.12.
Users are recommended to upgrade to version 6.4.0, 6.3.3 or 5.19.12, which fixes the issue.
Exploit likelihood
What each source reports
CVE List No score
Apache ActiveMQ, Apache ActiveMQ Runtime Config: ActiveMQ retains write access after live ACL revocation
Improper invalidation of cached authorizations vulnerability in Apache ActiveMQ, Apache ActiveMQ Runtime Config.
After the runtime configuration plugin removes a principal's write grant on a destination, an authenticated connection opened before the change can keep sending to that destination, including through a new anonymous producer, while fresh connections and new explicit producers are denied.
This issue affects Apache ActiveMQ: from 6.0.0 before 6.3.3, before 5.19.12; Apache ActiveMQ Runtime Config: from 6.0.0 before 6.3.3, before 5.19.12.
Users are recommended to upgrade to version 6.4.0, 6.3.3 or 5.19.12, which fixes the issue.
- Record
CVE-2026-111822- Updated
- 2026-11-04
EUVDEUVD-2026-116827 No score
Improper invalidation of cached authorizations vulnerability in Apache ActiveMQ, Apache ActiveMQ Runtime Config.
After the runtime configuration plugin removes a principal's write grant on a destination, an authenticated connection opened before the change can keep sending to that destination, including through a new anonymous producer, while fresh connections and new explicit producers are denied.
This issue affects Apache ActiveMQ: from 6.0.0 before 6.3.3, before 5.19.12; Apache ActiveMQ Runtime Config: from 6.0.0 before 6.3.3, before 5.19.12.
Users are recommended to upgrade to version 6.4.0, 6.3.3 or 5.19.12, which fixes the issue.
- Record
EUVD-2026-116827- Updated
- 2026-11-04
GitHub AdvisoriesGHSA-5jrv-f37p-8c36 No score
Improper invalidation of cached authorizations vulnerability in Apache ActiveMQ, Apache ActiveMQ...
Improper invalidation of cached authorizations vulnerability in Apache ActiveMQ, Apache ActiveMQ Runtime Config.
After the runtime configuration plugin removes a principal's write grant on a destination, an authenticated connection opened before the change can keep sending to that destination, including through a new anonymous producer, while fresh connections and new explicit producers are denied.
This issue affects Apache ActiveMQ: from 6.0.0 before 6.3.3, before 5.19.12; Apache ActiveMQ Runtime Config: from 6.0.0 before 6.3.3, before 5.19.12.
Users are recommended to upgrade to version 6.4.0, 6.3.3 or 5.19.12, which fixes the issue.
- Record
GHSA-5jrv-f37p-8c36- Updated
- 2026-11-04
NVD No score
Improper invalidation of cached authorizations vulnerability in Apache ActiveMQ, Apache ActiveMQ Runtime Config.
After the runtime configuration plugin removes a principal's write grant on a destination, an authenticated connection opened before the change can keep sending to that destination, including through a new anonymous producer, while fresh connections and new explicit producers are denied.
This issue affects Apache ActiveMQ: from 6.0.0 before 6.3.3, before 5.19.12; Apache ActiveMQ Runtime Config: from 6.0.0 before 6.3.3, before 5.19.12.
Users are recommended to upgrade to version 6.4.0, 6.3.3 or 5.19.12, which fixes the issue.
- Record
CVE-2026-111822- Updated
- 2026-11-04
OSVDEBIAN-CVE-2026-111822 No score
Improper invalidation of cached authorizations vulnerability in Apache ActiveMQ, Apache ActiveMQ Runtime Config. After the runtime configuration plugin removes a principal's write grant on a destination, an authenticated connection opened before the change can keep sending to that destination, including through a new anonymous producer, while fresh connections and new explicit producers are denied. This issue affects Apache ActiveMQ: from 6.0.0 before 6.3.3, before 5.19.12; Apache ActiveMQ Runtime Config: from 6.0.0 before 6.3.3, before 5.19.12. Users are recommended to upgrade to version 6.4.0, 6.3.3 or 5.19.12, which fixes the issue.
- Record
DEBIAN-CVE-2026-111822- Updated
- 2026-11-06
OSVUBUNTU-CVE-2026-111822 No score
Improper invalidation of cached authorizations vulnerability in Apache ActiveMQ, Apache ActiveMQ Runtime Config. After the runtime configuration plugin removes a principal's write grant on a destination, an authenticated connection opened before the change can keep sending to that destination, including through a new anonymous producer, while fresh connections and new explicit producers are denied. This issue affects Apache ActiveMQ: from 6.0.0 before 6.3.3, before 5.19.12; Apache ActiveMQ Runtime Config: from 6.0.0 before 6.3.3, before 5.19.12. Users are recommended to upgrade to version 6.4.0, 6.3.3 or 5.19.12, which fixes the issue.
- Record
UBUNTU-CVE-2026-111822- Updated
- 2026-11-05
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
activemqDebian:12 |
All versions, plus listed versions 5.17.2+dfsg-25.17.2+dfsg-2+deb12u15.17.6+dfsg-15.17.6+dfsg-2 |
None known |
activemqDebian:13 |
All versions, plus listed versions 5.17.6+dfsg-2 |
None known |
activemqUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 5.6.0+dfsg1-4+deb8u1ubuntu15.6.0+dfsg1-55.13.2+dfsg-25.13.2+dfsg-2ubuntu0.1~esm1 |
None known |
activemqUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 5.14.5-35.15.2-25.15.3-25.15.8-2~18.045.15.8-2~18.04.1~esm1 |
None known |
activemqUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 5.15.10-15.15.11-15.15.11-1ubuntu0.1~esm1 |
None known |
activemqUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 5.16.1-15.16.1-1ubuntu0.1~esm15.16.1-1ubuntu0.1 |
None known |
activemqUbuntu:24.04:LTS |
All versions, plus listed versions 5.17.2+dfsg-25.17.6+dfsg-1 |
None known |
activemqUbuntu:26.10 |
All versions, plus listed versions 5.17.6+dfsg-25.17.6+dfsg-2ubuntu1 |
None known |
activemqUbuntu:26.04:LTS |
All versions, plus listed versions 5.17.6+dfsg-2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| affected, aliases, references | GitHub Advisories, NVD, OSV | |
| published | EUVD | |
| published | EUVD | |
| references | CVE List, EUVD | |
| aliases, references | GitHub Advisories | |
| references, title | CVE List, NVD | |
| first indexed | EUVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-111822 is a vulnerability with no CVSS score yet in Apache Software Foundation Activemq, published November 4, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.22%, the 12th percentile. No source names a fixed version.
References
lists.apache.org/thread/b5gop0kwsm4sr1pgdrfcd14q8hx942j5
openwall.com/lists/oss-security/2026/11/03/20
nvd.nist.gov/vuln/detail/CVE-2026-111822
github.com/advisories/GHSA-5jrv-f37p-8c36
security-tracker.debian.org/tracker/CVE-2026-111822
ubuntu.com/security/CVE-2026-111822
cve.org/CVERecord?id=CVE-2026-111822