CVE-2026-54475: Apache ActiveMQ Temporary Destination Authorization Bypass

Technical summary

CVE-2026-54475 is a missing authorization flaw (CWE-862) in Apache ActiveMQ's temporary destination handling. The vulnerability stems from client-side-only enforcement of destination isolation. Temporary destinations are created per-connection and should restrict consumption to that connection alone. However, because the broker does not enforce this isolation server-side, a separate connection can send consume requests to another connection's temporary destination and successfully retrieve messages. The vulnerability affects ActiveMQ Classic versions before 5.19.8 and 6.0.0 through 6.2.6. The CVSS 3.1 score of 7.5 (High) reflects network-accessible unauthorized data access with no authentication requirement.

Business impact

Temporary message queues are often used in request-reply patterns and contain sensitive application data. Unauthorized message consumption could expose confidential business communications, credentials passed through queues, or proprietary data in transit. In multi-tenant or shared ActiveMQ deployments, this creates cross-tenant data leakage risk. Organizations relying on ActiveMQ for internal secure messaging channels may inadvertently expose application secrets or customer data to an attacker positioned on the network.

Affected systems

Three Apache product variants are affected: Apache ActiveMQ Broker (versions before 5.19.8 and 6.0.0–6.2.6), Apache ActiveMQ All (same version ranges), and Apache ActiveMQ (same version ranges). The vulnerability does not affect patched versions 5.19.8 or 6.2.7 and later. Legacy 5.x deployments and active 6.x installations in pre-6.2.7 state are at risk.

Exploitability

Exploitability is straightforward for an attacker with network access to the ActiveMQ broker. No credentials, authentication, or user interaction are required. The attack is deterministic: an attacker simply connects to the broker and subscribes to or consumes from a known or enumerable temporary destination name belonging to another connection. This makes it practically exploitable in any environment where the broker is reachable from untrusted networks or shared infrastructure. However, the attacker must already have network connectivity to the broker port, so fully isolated internal deployments have reduced risk.

Remediation

Upgrade Apache ActiveMQ to version 5.19.8 or later, or version 6.2.7 or later. These versions implement server-side authorization checks that enforce isolation of temporary destinations. There are no known configuration workarounds; patching is the only remediation. Organizations unable to patch immediately should restrict network access to the ActiveMQ broker port and apply network-level segmentation to limit who can connect.

Patch guidance

Apply the vendor patch by upgrading to Apache ActiveMQ 5.19.8+ (for the 5.x line) or 6.2.7+ (for the 6.x line). Verify the installed version using the ActiveMQ distribution version command or broker logs. Test the patched version in a non-production environment first, particularly if custom clients or integrations depend on ActiveMQ. Review release notes for any breaking changes between your current and target version. Coordinate the upgrade during a maintenance window to avoid service disruption.

Detection guidance

Monitor ActiveMQ broker logs for unexpected consume operations on temporary destinations from connections that did not create them. Temporary destination names typically follow patterns like 'ID:hostname-port-timestamp:1:1:temp-topic' or similar. Enable detailed audit logging if your ActiveMQ deployment supports it. Network-level detection is difficult without instrumentation, so focus on broker-side logs and consider implementing client-side message auditing to detect unexpected consumption patterns. A connection consuming from multiple temporary destinations in rapid succession is a behavioral red flag.

Why prioritize this

This vulnerability scores 7.5 (High) because it enables confidential data access over the network without authentication. Temporary queues are commonly used for sensitive application messaging in enterprise deployments. The ease of exploitation—no special tools or credentials needed—makes it attractive to internal threat actors and network-positioned attackers. Organizations with exposed ActiveMQ brokers or those handling sensitive data through temporary queues should prioritize patching. The absence of KEV status does not reduce urgency; this is a straightforward authorization bypass with clear real-world impact.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects: (1) Network-adjacent attack vector requiring only broker reachability, (2) Low complexity with no special conditions, (3) No authentication requirement, (4) High confidentiality impact (unauthorized message read access), and (5) Integrity and availability not directly affected by the vulnerability itself. The score appropriately captures the unauthorized data disclosure risk while acknowledging that the attack does not corrupt data or take the broker offline.

Frequently asked questions