CVE-2026-46605

MEDIUM 4.3

Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incomplete authorization during destination removal

CVSS Score

4.3

EPSS Score

0.0%

EPSS Percentile

3th

Incomplete authorization by Apache ActiveMQ server before versions v6.2.6 and v5.19.7 allows authenticated connections to remove existing destinations with proper permissions. This issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ All: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6. Users are recommended to upgrade to version v6.2.6 or v5.19.7, which fixes the issue.

CWE	CWE-285
Vendor	apache software foundation
Product	apache activemq broker
Published	Jun 1, 2026
Last Updated	Jun 1, 2026

Stay Ahead of the Next One

Get instant alerts for apache software foundation apache activemq broker

Be the first to know when new medium vulnerabilities affecting apache software foundation apache activemq broker are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Apache Software Foundation / Apache ActiveMQ Broker

0 < 5.19.7 6.0.0 < 6.2.6

Apache Software Foundation / Apache ActiveMQ All

0 < 5.19.7 6.0.0 < 6.2.6

Apache Software Foundation / Apache ActiveMQ

0 < 5.19.7 6.0.0 < 6.2.6

References

NVD ↗ CVE.org ↗ EPSS Data ↗

lists.apache.org: https://lists.apache.org/thread/l4lxgr2s73g9pb218f180psfyskf8ldm openwall.com: http://www.openwall.com/lists/oss-security/2026/05/31/20

Credits

Leon Johnson (github: lokerxx)