CVE-2026-74761 Overview
CVE-2026-74761 is an improper input validation vulnerability [CWE-20] in the TopicRegion component of Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All. An authenticated client can spoof the clientId when removing a durable topic subscription. The flaw allows a legitimate broker user to interfere with subscriptions belonging to other clients by supplying a forged identifier during the removal operation.
The vulnerability affects Apache ActiveMQ Broker, Apache ActiveMQ All, and Apache ActiveMQ prior to 5.19.11, and versions 6.0.0 through 6.3.1. The Apache ActiveMQ project has released fixed versions 6.3.2 and 5.19.11.
Critical Impact
An authenticated client can spoof another user's clientId to remove durable topic subscriptions, disrupting message delivery and enabling denial of service against legitimate subscribers.
Affected Products
- Apache ActiveMQ Broker: before 5.19.11, and 6.0.0 through 6.3.1
- Apache ActiveMQ All: before 5.19.11, and 6.0.0 through 6.3.1
- Apache ActiveMQ: before 5.19.11, and 6.0.0 through 6.3.1
Discovery Timeline
- 2026-09-09 - CVE-2026-74761 published to the National Vulnerability Database (NVD)
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-74761
Vulnerability Analysis
Apache ActiveMQ is a widely deployed open-source message broker that implements the Java Message Service (JMS) specification. Durable topic subscriptions in JMS allow clients to receive messages published while the subscriber was offline. Each durable subscription is uniquely identified by a combination of clientId and subscription name.
The vulnerability resides in the TopicRegion class, which manages topic subscriptions within the broker. When an authenticated client issues a request to remove a durable subscription, the broker fails to validate that the supplied clientId matches the identifier associated with the authenticated session. This missing input validation allows one authenticated user to reference another user's clientId in the removal request.
Exploitation results in unauthorized deletion of durable subscriptions belonging to other users. Legitimate subscribers lose queued messages and stop receiving new events on the affected topic, producing a targeted denial of service against message consumers.
Root Cause
The root cause is improper input validation [CWE-20] in the durable subscription removal path within TopicRegion. The broker treats the client-supplied clientId parameter as authoritative rather than binding the removal operation to the authenticated session's identity.
Attack Vector
An attacker requires valid broker credentials to reach the vulnerable code path. Once authenticated, the attacker crafts a durable subscription removal request that specifies a clientId and subscription name belonging to a different user. The broker processes the request without verifying ownership and removes the targeted subscription.
The attack requires prior knowledge or enumeration of victim clientId values and durable subscription names. In shared multi-tenant broker deployments, this information is often discoverable through management interfaces or predictable naming conventions.
No verified public proof-of-concept code is available. Refer to the Apache Mailing List Discussion and the Openwall OSS Security Update for authoritative technical detail.
Detection Methods for CVE-2026-74761
Indicators of Compromise
- Unexpected RemoveSubscriptionInfo commands in broker audit logs referencing clientId values that differ from the authenticated user's session identifier.
- Sudden disappearance of durable subscriptions without corresponding administrative action or client disconnect events.
- Complaints from downstream consumers about missing messages on topics they were subscribed to.
Detection Strategies
- Enable ActiveMQ audit logging and correlate the authenticated principal with the clientId field on every subscription removal event.
- Alert when a single authenticated user removes durable subscriptions associated with multiple distinct clientId values in a short timeframe.
- Baseline normal subscription lifecycle patterns per user and flag deviations, particularly removals targeting long-lived durable subscriptions.
Monitoring Recommendations
- Forward ActiveMQ broker logs to a centralized logging or SIEM platform for retention and cross-user correlation.
- Monitor JMX metrics for DurableTopicSubscribers count and alert on unexpected decreases.
- Track authentication events and correlate them with subsequent administrative operations against subscription state.
How to Mitigate CVE-2026-74761
Immediate Actions Required
- Upgrade Apache ActiveMQ, ActiveMQ Broker, and ActiveMQ All to version 6.3.2 (for the 6.x branch) or 5.19.11 (for the 5.x branch).
- Inventory all ActiveMQ deployments and identify brokers running affected versions before applying updates.
- Review recent broker audit logs for evidence of unauthorized durable subscription removals prior to patching.
Patch Information
The Apache ActiveMQ project has released fixed builds. Users on the 6.x branch should upgrade to 6.3.2 or later. Users on the 5.x branch should upgrade to 5.19.11 or later. Reference the Apache Mailing List Discussion for the official announcement.
Workarounds
- Restrict broker credentials so that only trusted, isolated applications hold accounts with subscription privileges.
- Apply strict JAAS authorization policies to limit which authenticated principals can create or remove durable subscriptions on shared topics.
- Segment multi-tenant workloads onto separate broker instances until patched versions can be deployed.
# Verify installed ActiveMQ version and confirm remediation
$ACTIVEMQ_HOME/bin/activemq --version
# Expected output for remediated deployments:
# ActiveMQ 6.3.2 (or) ActiveMQ 5.19.11
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
