WaratekVRT Sign in

CVE-2026-54475

Affected software2 products, listed below
Severity7.5 High CVSS 3.1
Fixed in5.19.8, 6.2.7
WeaknessMissing authorization (CWE-862)
Published30 Jun 2026
Updated2 Jul 2026

Description

Missing Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. Apache ActiveMQ Classic temporary destinations are expected to be isolated to the connection that created them. The isolation can be broken as this is only checked in the client, allowing a different connection to consume from another connection's temporary destination. This issue affects Apache ActiveMQ Broker: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7. Users are recommended to upgrade to version 6.2.7, which fixes the issue.

Exploitation status

No public exploit

No exploit has been reported in the sources we check.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment exploitation: none
  • Indexed PoC none indexed
  • EPSS 0.56% chance in 30 days

Waratek protection

No exploit published

Within Waratek scope. In the sources we check, nobody has published exploit code for this CVE or reported it being exploited.

A public code fix exists: apache/activemq #2122.

  • Protection none
  • Action unverified
  • Review automated Upstream data
  • Record active
Decided by Exploit code for this candidate, published in a reviewed catalogue or a GitHub repository with 5 or more stars, or in use per CISA or VulnCheck; not only a CISA verdict, a forecast, or nothing at all
Finding This CVE is not listed in CISA KEV or VulnCheck KEV, CISA Vulnrichment records no active exploitation, no reviewed exploit catalogue carries an entry for it, and no GitHub PoC repository for it has 5 or more stars. Nobody has published exploit code worth tracing, so it is not a candidate for a rule ahead of the ones where somebody has; an upstream fix path does exist, so the remediation half of the candidacy still holds. This is a statement about what has been published, not about whether the defect is reachable or serious.

Affected software and releases

Maven packages

Affected and fixed versions, from OSV.dev
PackageIntroducedFixedLast affected
org.apache.activemq:activemq-broker 0 5.19.8 unbounded
org.apache.activemq:activemq-broker 6.0.0 6.2.7 unbounded
org.apache.activemq:activemq-all 0 5.19.8 unbounded
org.apache.activemq:activemq-all 6.0.0 6.2.7 unbounded
org.apache.activemq:apache-activemq 0 5.19.8 unbounded
org.apache.activemq:apache-activemq 6.0.0 6.2.7 unbounded

Products and versions

5 products, 10 version entries
SourceVendorProductSchemeAffected versions
nvd apache activemq generic ＜ 5.19.8 · ≥ 6.0.0 and ＜ 6.2.7
nvd apache activemq broker generic ＜ 5.19.8 · ≥ 6.0.0 and ＜ 6.2.7
osv org.apache.activemq activemq-all generic ＜ 5.19.8 · ≥ 6.0.0 and ＜ 6.2.7
osv org.apache.activemq activemq-broker generic ＜ 5.19.8 · ≥ 6.0.0 and ＜ 6.2.7
osv org.apache.activemq apache-activemq generic ＜ 5.19.8 · ≥ 6.0.0 and ＜ 6.2.7

References

URLTags
https://github.com/apache/activemq/pull/2122 WEB
https://github.com/apache/activemq/commit/225dcb649c5994463df12549a3f4eb9f6c509b34 WEB
https://github.com/apache/activemq/commit/708c90f2c0f0d874649ea0f0454760668a8f90fc WEB
https://github.com/apache/activemq/commit/d8c5672e224883a16465f8550d0e6d900bfa383c WEB
https://github.com/apache/activemq PACKAGE
https://github.com/apache/activemq/releases/tag/activemq-5.19.8 WEB
https://github.com/apache/activemq/releases/tag/activemq-6.2.7 WEB
https://lists.apache.org/thread/85f3q7mkh71y7qwyn6wvgw0bw4jl06ys WEB
http://www.openwall.com/lists/oss-security/2026/06/29/15 WEB

Timeline
Published2026-06-30By the CVE Program.
NVD record modified2026-07-02NVD's own last-modified date for this record.