{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-111822", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-10-16T23:01:32.304Z", "datePublished": "2026-11-04T10:12:08.183Z", "dateUpdated": "2026-11-04T12:11:26.492Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-11-04T10:12:08.183Z"}, "title": "Apache ActiveMQ, Apache ActiveMQ Runtime Config: ActiveMQ retains write access after live ACL revocation", "problemTypes": [{"descriptions": [{"description": "Improper invalidation of cached authorizations", "lang": "en"}]}], "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "Apache Software Foundation", "product": "Apache ActiveMQ", "packageURL": "pkg:maven/org.apache.activemq/apache-activemq", "versions": [{"status": "affected", "version": "6.0.0", "lessThan": "6.3.3", "versionType": "semver"}, {"status": "affected", "version": "0", "lessThan": "5.19.12", "versionType": "semver"}], "defaultStatus": "unaffected", "collectionURL": "https://repo.maven.apache.org/maven2", "packageName": "org.apache.activemq:apache-activemq"}, {"vendor": "Apache Software Foundation", "product": "Apache ActiveMQ Runtime Config", "packageURL": "pkg:maven/org.apache.activemq/activemq-runtime-config", "versions": [{"status": "affected", "version": "6.0.0", "lessThan": "6.3.3", "versionType": "semver"}, {"status": "affected", "version": "0", "lessThan": "5.19.12", "versionType": "semver"}], "defaultStatus": "unaffected", "collectionURL": "https://repo.maven.apache.org/maven2", "packageName": "org.apache.activemq:activemq-runtime-config"}], "descriptions": [{"value": "Improper invalidation of cached authorizations vulnerability in Apache ActiveMQ, Apache ActiveMQ Runtime Config.\n\n\n\nAfter the runtime configuration plugin removes a principal's write grant on a destination, an authenticated connection opened before the change can keep sending to that destination, including through a new anonymous producer, while fresh connections and new explicit producers are denied.\n\n\n\nThis issue affects Apache ActiveMQ: from 6.0.0 before 6.3.3, before 5.19.12; Apache ActiveMQ Runtime Config: from 6.0.0 before 6.3.3, before 5.19.12.\n\n\n\nUsers are recommended to upgrade to version 6.4.0, 6.3.3 or 5.19.12, which fixes the issue.", "lang": "en", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Improper invalidation of cached authorizations vulnerability in Apache ActiveMQ, Apache ActiveMQ Runtime Config.</p><p>After the runtime configuration plugin removes a principal's write grant on a destination, an authenticated connection opened before the change can keep sending to that destination, including through a new anonymous producer, while fresh connections and new explicit producers are denied.</p><p><span>This issue affects Apache ActiveMQ: from 6.0.0 before 6.3.3, before 5.19.12; Apache ActiveMQ Runtime Config: from 6.0.0 before 6.3.3, before 5.19.12.</span></p><p>Users are recommended to upgrade to version 6.4.0, 6.3.3 or 5.19.12, which fixes the issue.</p>"}]}], "references": [{"url": "https://lists.apache.org/thread/b5gop0kwsm4sr1pgdrfcd14q8hx942j5", "tags": ["vendor-advisory"]}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "important"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "credits": [{"lang": "en", "value": "hataehoon", "type": "finder"}], "x_generator": {"engine": "Vulnogram 1.0.3"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/11/03/20"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-11-04T12:11:26.492Z"}}]}}

{}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "org.apache.activemq:apache-activemq", "packageURL": "pkg:maven/org.apache.activemq/apache-activemq", "product": "Apache ActiveMQ", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "6.3.3", "status": "affected", "version": "6.0.0", "versionType": "semver"}, {"lessThan": "5.19.12", "status": "affected", "version": "0", "versionType": "semver"}]}, {"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "org.apache.activemq:activemq-runtime-config", "packageURL": "pkg:maven/org.apache.activemq/activemq-runtime-config", "product": "Apache ActiveMQ Runtime Config", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "6.3.3", "status": "affected", "version": "6.0.0", "versionType": "semver"}, {"lessThan": "5.19.12", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@apache.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper invalidation of cached authorizations vulnerability in Apache ActiveMQ, Apache ActiveMQ Runtime Config.\n\n\n\nAfter the runtime configuration plugin removes a principal's write grant on a destination, an authenticated connection opened before the change can keep sending to that destination, including through a new anonymous producer, while fresh connections and new explicit producers are denied.\n\n\n\nThis issue affects Apache ActiveMQ: from 6.0.0 before 6.3.3, before 5.19.12; Apache ActiveMQ Runtime Config: from 6.0.0 before 6.3.3, before 5.19.12.\n\n\n\nUsers are recommended to upgrade to version 6.4.0, 6.3.3 or 5.19.12, which fixes the issue."}], "id": "CVE-2026-111822", "lastModified": "2026-11-04T14:10:09.713", "metrics": {}, "published": "2026-11-04T10:17:25.500", "references": [{"source": "security@apache.org", "url": "https://lists.apache.org/thread/b5gop0kwsm4sr1pgdrfcd14q8hx942j5"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/11/03/20"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Awaiting Analysis"}

{"bugzilla": {"description": "org.apache.activemq/activemq-runtime-config: Apache ActiveMQ: Authorization bypass via improper cache invalidation", "id": "2566822", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2566822"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "status": "draft"}, "cwe": "CWE-613", "details": ["Improper invalidation of cached authorizations vulnerability in Apache ActiveMQ, Apache ActiveMQ Runtime Config.\nAfter the runtime configuration plugin removes a principal's write grant on a destination, an authenticated connection opened before the change can keep sending to that destination, including through a new anonymous producer, while fresh connections and new explicit producers are denied.\nThis issue affects Apache ActiveMQ: from 6.0.0 before 6.3.3, before 5.19.12; Apache ActiveMQ Runtime Config: from 6.0.0 before 6.3.3, before 5.19.12.\nUsers are recommended to upgrade to version 6.4.0, 6.3.3 or 5.19.12, which fixes the issue.", "A flaw was found in the Apache ActiveMQ Runtime Configuration plugin. An authenticated user can bypass revoked permissions and continue sending messages to a restricted destination if their connection was established prior to the authorization update. Because the system fails to properly invalidate cached permissions when access rights are removed, existing connections retain unauthorized write access."], "mitigation": {"lang": "en:us", "value": "Upgrade to a version containing the upstream fix (ActiveMQ Runtime Config 5.19.12 / 6.3.3 / 6.4.0) when available. As a workaround, restart existing connections (or the broker) after revoking write grants so cached authorizations are dropped, and do not rely on runtime ACL revocation to constrain already-authenticated connections."}, "name": "CVE-2026-111822", "package_state": [{"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Out of support scope", "package_name": "activemq-runtime-config", "product_name": "Red Hat Fuse 7"}], "public_date": "2026-11-04T10:12:08Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-111822\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-111822\nhttps://lists.apache.org/thread/b5gop0kwsm4sr1pgdrfcd14q8hx942j5"], "statement": "A flaw was found in the Apache ActiveMQ Runtime Configuration plugin. When a principal's write grant on a destination is removed via runtime configuration, an authenticated connection established before the change can continue sending to that destination, including through a new anonymous producer, while fresh connections and new explicit producers are denied. Red Hat Fuse 7 ships org.apache.activemq:activemq-runtime-config 5.11.0.redhat-630517, which is before the upstream fix (5.19.12), and is therefore affected.", "threat_severity": "Moderate"}