CVE-2026-61487

Name of the Vulnerable Software and Affected Versions Apache ActiveMQ Broker versions prior to 5.19.9 Apache ActiveMQ Broker versions 6.0.0 through 6.2.7 Apache ActiveMQ All versions prior to 5.19.9 Apache ActiveMQ All versions 6.0.0 through 6.2.7 Apache ActiveMQ versions prior to 5.19.9 Apache ActiveMQ versions 6.0.0 through 6.2.7

Description An authenticated low-privilege user can bypass per-destination write Access Control Lists (ACL) by sending messages to a temporary composite destination. By using a physical name that is a comma-separated composite of real queues, the user can publish messages to any destination in that list. This occurs because the authorization check is bypassed when the composite destination is marked as temporary.

Recommendations Upgrade Apache ActiveMQ Broker to version 5.19.9, 6.2.8, or 6.3.0. Upgrade Apache ActiveMQ All to version 5.19.9, 6.2.8, or 6.3.0. Upgrade Apache ActiveMQ to version 5.19.9, 6.2.8, or 6.3.0.