CVE-2026-108500
Apache ActiveMQ: LDAPAuthorizationMap allows authorization bypass via DN injection
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Input validation vulnerability in Apache ActiveMQ configured to use the LDAPAuthorizationMapPlugin allows an authenticated attacker to create or address a destination with a crafted name containing LDAP DN special characters (such as comma, plus, equals, backslash) can manipulate the LDAP search base used for ACL lookups. This issue affects Apache ActiveMQ: from 6.3.0 before 6.3.3, from 5.19.0 before 5.19.12. Users are recommended to upgrade to version 6.4.0, 6.3.3 or 5.19.12, which fixes the issue.
| CWE | CWE-20 |
| Vendor | apache software foundation |
| Product | apache activemq |
| Published | Nov 4, 2026 |
Stay Ahead of the Next One
Get instant alerts for apache software foundation apache activemq
Be the first to know when new unknown vulnerabilities affecting apache software foundation apache activemq are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Apache Software Foundation / Apache ActiveMQ
6.3.0 < 6.3.3 5.19.0 < 5.19.12
References
Credits
Rishabh Soni (Azmendus) <[email protected]>