CVE-2026-61487: Apache ActiveMQ Auth Bypass Vulnerability

CVE-2026-61487 Overview

CVE-2026-61487 is an improper authorization vulnerability [CWE-285] in Apache ActiveMQ that allows authenticated low-privilege users to bypass per-destination write access control lists (ACLs). The flaw affects Apache ActiveMQ Broker, Apache ActiveMQ All, and Apache ActiveMQ distributions before 5.19.9 and versions 6.0.0 through 6.2.7. An attacker exploits the flaw by publishing to a temporary composite destination whose physical name embeds a comma-separated list of real queues. The broker treats the composite as temporary and skips ACL enforcement, permitting message injection into any listed queue.

Critical Impact
An authenticated low-privilege user can publish messages to any queue in the broker, bypassing per-destination write ACLs and compromising message integrity across the messaging fabric.

Affected Products

Apache ActiveMQ Broker before 5.19.9 and 6.0.0 through 6.2.7
Apache ActiveMQ All before 5.19.9 and 6.0.0 through 6.2.7
Apache ActiveMQ before 5.19.9 and 6.0.0 through 6.2.7

Discovery Timeline

2026-07-28 - CVE-2026-61487 published to the National Vulnerability Database (NVD)
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-61487

Vulnerability Analysis

Apache ActiveMQ supports composite destinations, allowing producers to publish a single message that is fanned out to multiple queues or topics. The broker uses a comma-separated physical name to represent the list of destinations. Separately, ActiveMQ supports temporary destinations, which are session-scoped and exempt from per-destination ACL checks because they only exist for the lifetime of the client session.

The vulnerability arises when a client creates a temporary composite destination whose physical name lists real, ACL-protected queues. The authorization layer inspects the destination's temporary flag and short-circuits the write ACL evaluation. As a result, the broker delivers the message to every queue in the composite list without verifying that the sending principal holds write permissions on those queues.

Root Cause

The root cause is a logic error in the authorization plugin's handling of composite destinations marked as temporary. The authorization check treats the temporary attribute as authoritative for the entire composite and does not iterate over each embedded destination to enforce the configured ACL. The design conflates two independent concerns: destination lifetime and access control scope.

Attack Vector

An authenticated user with minimal privileges connects to the broker over a supported transport such as OpenWire, AMQP, or STOMP. The attacker creates a temporary composite destination and sets its physical name to a comma-separated list of target queues that the attacker is otherwise not authorized to write to. Sending a message to this composite results in the broker fanning the payload into all listed queues. No user interaction and no elevated privileges are required beyond a valid low-privilege broker credential.

No verified public exploit code is available at the time of publication. See the Apache Mailing List Thread and the OpenWall OSS Security Post for the vendor advisory.

Detection Methods for CVE-2026-61487

Indicators of Compromise

Broker logs showing creation of temporary destinations with unusually long or comma-delimited physical names referencing production queue names.
Messages appearing in restricted queues from principals that have no configured write ACL entry for those queues.
Sudden spikes in producer activity from low-privilege service accounts targeting composite destinations.

Detection Strategies

Enable the ActiveMQ audit log and parse ActiveMQ.Advisory.TempQueue and ActiveMQ.Advisory.TempTopic advisory topics for destination creation events containing commas in the physical name.
Correlate authenticated JMS session identifiers with the set of destinations they publish to and alert when the destination set exceeds the principal's ACL entitlements.
Baseline normal producer-to-queue mappings and flag deviations where a single session writes to multiple restricted queues via one destination reference.

Monitoring Recommendations

Ingest ActiveMQ broker logs and JMX metrics into a centralized SIEM for continuous review of destination usage patterns.
Alert on any temporary destination whose name contains the delimiter character , or matches known production queue substrings.
Track message counts per queue and correlate with the authenticated identity of the producer to identify ACL bypass attempts.

How to Mitigate CVE-2026-61487

Immediate Actions Required

Upgrade Apache ActiveMQ to version 5.19.9, 6.2.8, or 6.3.0, which contain the authorization fix.
Audit broker ACL configurations and rotate credentials for any low-privilege accounts that may have been used to exploit the flaw.
Review broker logs for historical creation of temporary composite destinations with comma-separated physical names.

Patch Information

The Apache ActiveMQ project has released fixed versions 5.19.9, 6.2.8, and 6.3.0. The patch corrects the authorization plugin so composite destinations are decomposed and each constituent destination is evaluated against the write ACL regardless of the temporary flag. Details are available in the Apache Mailing List Thread.

Workarounds

Restrict broker access to trusted networks and enforce mutual TLS to reduce the population of authenticated principals capable of reaching the flaw.
Disable composite destination support in client-facing transports where the feature is not required by application logic.
Tighten authentication so no shared low-privilege accounts remain, ensuring every producer identity maps to a specific ACL policy.

bash

# Verify installed ActiveMQ version and confirm it is patched
./activemq --version

# Example: enforce authorization plugin in conf/activemq.xml
# <authorizationPlugin>
#   <map>
#     <authorizationMap>
#       <authorizationEntries>
#         <authorizationEntry queue=">" write="admins" read="admins" admin="admins"/>
#       </authorizationEntries>
#     </authorizationMap>
#   </map>
# </authorizationPlugin>