CVE-2026-61487: Apache ActiveMQ Authorization Bypass via Temporary Composite Destinations
Summary
CVE-2026-61487: Improper Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. Affects activemq across 2 version ranges.
< 5.19.9
>= 6.0.0, < 6.2.8
Fixed in 5.19.9 or 6.2.8, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache ActiveMQ is an open-source message broker that facilitates communication between applications through message queuing. It supports various messaging protocols and is widely used for its reliability and scalability. However, it has a vulnerability that allows low-privilege users to bypass authorization checks, potentially leading to unauthorized message publishing.
Vulnerability Detail
The vulnerability arises from improper authorization checks in Apache ActiveMQ Broker, ActiveMQ All, and ActiveMQ. An authenticated low-privilege user can exploit this flaw by sending messages to a temporary composite destination, which is a combination of real queues. This allows the user to publish messages to any destination in the list without the necessary write ACL permissions, as the authorization check is bypassed due to the temporary nature of the composite destination. This could lead to unauthorized access to sensitive information or disruption of message flows.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 5.19.95.19.9 -
>= 6.0.0, < 6.2.86.2.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, it is recommended to restrict access to temporary composite destinations until the upgrade can be performed. This can be done by reviewing and modifying the access control lists (ACLs) to ensure that low-privilege users do not have permissions to send messages to these destinations.
Conclusion
The CVE-2026-61487 vulnerability in Apache ActiveMQ poses significant risks by allowing unauthorized message publishing through temporary composite destinations. Users are strongly advised to upgrade to the patched versions to mitigate these risks. For those unable to upgrade immediately, implementing stricter access controls can serve as a temporary solution.
See every vulnerability recorded for activemq →
FAQ
CVE-2026-61487 is a vulnerability in Apache ActiveMQ that allows low-privilege users to bypass authorization checks when sending messages to temporary composite destinations.
Users of Apache ActiveMQ Broker, ActiveMQ All, and ActiveMQ versions before 5.19.9 and between 6.0.0 and 6.2.8 are affected by this vulnerability.
The risks include unauthorized message publishing, potential data leaks, and disruption of message flows, which can compromise application integrity and security.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By simply uploading your manifest file like package-lock.json, you can check for vulnerabilities without needing to access the code.
If an immediate upgrade is not possible, implement access control measures to restrict low-privilege users from accessing temporary composite destinations as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for activemq.
