CVE catalog

CVE-2026-54475

Missing Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. Apache ActiveMQ Classic temporary destinations are expected to be isolated to the connection that

[CVE catalog]

Severity: High · CVSS 8.2CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
Published: Jun 29, 2026, 10:00:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.56% · Oct 25, 2026

Missing Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. Apache ActiveMQ Classic temporary destinations are expected to be isolated to the connection that created them. The isolation can be broken as this is only checked in the client, allowing a different connection to consume from another connection's temporary destination. This issue affects Apache ActiveMQ Broker: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7. Users are recommended to upgrade to version 6.2.7, which fixes the issue.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	activemq	sid	`5.17.6+dfsg-2`	vulnerable
Debian	activemq	trixie	`5.17.6+dfsg-2`	vulnerable
Debian	activemq	bookworm	`5.17.2+dfsg-2+deb12u1`	vulnerable
Debian	activemq	bookworm-security	`5.17.2+dfsg-2+deb12u1`	vulnerable
Cpe	activemq	Not reported	Not reported	vulnerable
Cpe	activemq	Not reported	`5.19.8`	fixed
Cpe	activemq	Not reported	`6.2.7`	fixed
Cpe	activemq_broker	Not reported	`5.19.8`	fixed
Cpe	activemq_broker	Not reported	`6.2.7`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	activemq	source	sid	`(unfixed)`	not yet assigned	Not reported	[1141385]
Debian	activemq	source	trixie	`(unfixed)`	not yet assigned	Not reported	[1141385]
Debian	activemq	source	bookworm	`(unfixed)`	not yet assigned	Not reported	[1141385]
Cpe	activemq	cpe	Not reported	`5.19.8`	Not reported	Not reported	Not reported
Cpe	activemq	cpe	Not reported	`6.2.7`	Not reported	Not reported	Not reported
Cpe	activemq_broker	cpe	Not reported	`5.19.8`	Not reported	Not reported	Not reported
Cpe	activemq_broker	cpe	Not reported	`6.2.7`	Not reported	Not reported	Not reported

[Debian bug #1141385]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[activemq]Affected
Details (4)
- 5.17.2+dfsg-2+deb12u1 · all · bookworm
  Affected
  nvd · activemq · debian · bookworm; nvd · activemq · debian · 12
- 5.17.2+dfsg-2+deb12u1 · all · bookworm
  Affected
  nvd · activemq · debian · bookworm; nvd · activemq · debian · 12
- 5.17.2+dfsg-2+deb12u1 · all · bookworm-security
  Affected
  nvd · activemq · debian · bookworm; nvd · activemq · debian · 12
- 5.17.2+dfsg-2+deb12u1 · all · bookworm-security
  Affected
  nvd · activemq · debian · bookworm; nvd · activemq · debian · 12
[libactivemq-java]Affected
Source package: [activemq]
Details (4)
- 5.17.2+dfsg-2+deb12u1 · all · bookworm
  Affected
  nvd · activemq · debian · bookworm; nvd · activemq · debian · 12
- 5.17.2+dfsg-2+deb12u1 · all · bookworm
  Affected
  nvd · activemq · debian · bookworm; nvd · activemq · debian · 12
- 5.17.2+dfsg-2+deb12u1 · all · bookworm-security
  Affected
  nvd · activemq · debian · bookworm; nvd · activemq · debian · 12
- 5.17.2+dfsg-2+deb12u1 · all · bookworm-security
  Affected
  nvd · activemq · debian · bookworm; nvd · activemq · debian · 12

[Debian 13 (Trixie)]

[activemq]Affected
Details (2)
- 5.17.6+dfsg-2 · all · trixie
  Affected
  nvd · activemq · debian · 13
- 5.17.6+dfsg-2 · all · trixie
  Affected
  nvd · activemq · debian · 13
[libactivemq-java]Affected
Source package: [activemq]
Details (2)
- 5.17.6+dfsg-2 · all · trixie
  Affected
  nvd · activemq · debian · 13
- 5.17.6+dfsg-2 · all · trixie
  Affected
  nvd · activemq · debian · 13

Observed: Oct 23, 2026, 9:45:20 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]