CVE-2026-54475: Apache ActiveMQ Auth Bypass Vulnerability

CVE-2026-54475 Overview

CVE-2026-54475 is a Missing Authorization vulnerability [CWE-862] affecting Apache ActiveMQ Classic. Temporary destinations in ActiveMQ are expected to be isolated to the connection that created them. The isolation check is enforced only on the client side, so a separate connection can consume messages from another connection's temporary destination. The flaw affects Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All in versions before 5.19.8 and from 6.0.0 before 6.2.7. The Apache project recommends upgrading to version 6.2.7, which contains the fix.

Critical Impact
A remote unauthenticated attacker can consume messages from another connection's temporary destination, breaking message isolation and exposing integrity of message flows across broker clients.

Affected Products

Apache ActiveMQ Broker: before 5.19.8 and from 6.0.0 before 6.2.7
Apache ActiveMQ All: before 5.19.8 and from 6.0.0 before 6.2.7
Apache ActiveMQ: before 5.19.8 and from 6.0.0 before 6.2.7

Discovery Timeline

2026-06-30 - CVE-2026-54475 published to the National Vulnerability Database (NVD)
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-54475

Vulnerability Analysis

Apache ActiveMQ Classic supports temporary destinations, queues and topics scoped to a single JMS (Java Message Service) connection. These destinations should be readable only by the connection that created them. The broker relies on the client to enforce this restriction rather than validating consumer identity server-side. An attacker who knows or can enumerate the temporary destination name can create a separate connection and register a consumer against that destination. The broker delivers messages to the attacker's consumer because the authorization check never runs on the broker path. This breaks the confidentiality model of request-reply patterns that use temporary destinations for correlation.

Root Cause

The root cause is a missing server-side authorization check on consumer subscriptions to temporary destinations. Isolation logic exists only in the ActiveMQ client library, so any client that skips the check, or a custom client that speaks OpenWire or STOMP directly, can bypass it. The broker treats the subscription as legitimate and forwards messages destined for the original connection.

Attack Vector

The attack is network-based and requires no privileges or user interaction. An attacker connects to the broker, discovers or guesses a temporary destination name, and issues a subscription against it. Temporary destination names follow a predictable format based on the broker connection identifier, which increases the practicality of enumeration. Message flows using request-reply semantics, common in microservice and RPC deployments over JMS, are most exposed.

No verified public exploit code is available at time of publication. See the Apache Security Discussion and the OpenWall OSS Security Update for the vendor-provided technical detail.

Detection Methods for CVE-2026-54475

Indicators of Compromise

Consumer subscriptions on temporary destinations originating from a client identifier or remote IP address that does not match the connection that created the destination.
Unexpected message consumption rates on temporary queues or topics in advisory topics such as ActiveMQ.Advisory.Consumer.Queue.*.
Broker log entries showing multiple distinct sessions referencing the same temporary destination name.

Detection Strategies

Enable ActiveMQ advisory messages and audit consumer creation events on all temporary destinations, correlating the creating connection ID with the consuming connection ID.
Monitor OpenWire and STOMP traffic for CONSUMER_INFO or SUBSCRIBE frames referencing temporary destination prefixes (temp-queue:// or temp-topic://) from unexpected sources.
Ingest ActiveMQ broker and access logs into a security analytics platform to alert on cross-connection subscription patterns.

Monitoring Recommendations

Track version banners of Apache ActiveMQ instances across the environment to identify hosts still running versions below 5.19.8 or 6.2.7.
Alert on new client IPs consuming from temporary destinations, especially those outside the known application allowlist.
Baseline temporary destination lifetimes and consumer counts; investigate deviations that suggest unauthorized subscribers.

How to Mitigate CVE-2026-54475

Immediate Actions Required

Upgrade all Apache ActiveMQ, ActiveMQ Broker, and ActiveMQ All deployments to version 6.2.7, or to the 5.19.8 maintenance release on the 5.x branch.
Restrict network access to broker listeners (61616, 61613, 5672, 8161) to trusted application segments using firewall or service mesh policy.
Enforce authentication on all ActiveMQ transports and disable anonymous access where it remains enabled.

Patch Information

The Apache ActiveMQ project fixed the missing authorization check in version 6.2.7 on the 6.x branch and version 5.19.8 on the 5.x branch. Refer to the Apache Security Discussion for the official advisory text and release notes.

Workarounds

Apply broker-side authorization plugins that map users to allowed destinations, denying subscriptions to any temporary destination the user did not create.
Segment producers and consumers into separate broker instances or virtual hosts so untrusted clients cannot reach temporary destinations used by trusted flows.
Where request-reply patterns are used, migrate to authenticated named destinations with explicit ACLs until the upgrade to 6.2.7 is complete.

bash

# Example: enforce simple authorization on temporary destinations in activemq.xml
# Place inside <broker> ... </broker>
# <plugins>
#   <simpleAuthorizationPlugin>
#     <authorizationMap>
#       <authorizationEntries>
#         <authorizationEntry topic=">" read="admins" write="admins" admin="admins"/>
#         <authorizationEntry queue=">" read="admins" write="admins" admin="admins"/>
#         <tempDestinationAuthorizationEntry read="admins" write="admins" admin="admins"/>
#       </authorizationEntries>
#     </authorizationMap>
#   </simpleAuthorizationPlugin>
# </plugins>