CVE-2026-46605

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-46605
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-46605.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-46605
Aliases
Downstream
Published
2026-06-01T07:21:13.148Z
Modified
2026-07-24T03:56:47.060969421Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
Summary
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incomplete authorization during destination removal
Details

Incomplete authorization by Apache ActiveMQ server before versions v6.2.6 and v5.19.7 allows authenticated connections to remove existing destinations with proper permissions.

This issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ All: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6.

Users are recommended to upgrade to version v6.2.6 or v5.19.7, which fixes the issue.

Database specific 
{
    "cna_assigner": "apache",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "fixed": "5.19.7"
                },
                {
                    "introduced": "6.0.0"
                },
                {
                    "fixed": "6.2.6"
                },
                {
                    "fixed": "5.19.7"
                },
                {
                    "introduced": "6.0.0"
                },
                {
                    "fixed": "6.2.6"
                },
                {
                    "fixed": "5.19.7"
                },
                {
                    "introduced": "6.0.0"
                },
                {
                    "fixed": "6.2.6"
                }
            ],
            "source": "AFFECTED_FIELD"
        },
        {
            "extracted_events": [
                {
                    "fixed": "5.19.7"
                },
                {
                    "introduced": "6.0.0"
                },
                {
                    "fixed": "6.2.6"
                },
                {
                    "fixed": "5.19.7"
                },
                {
                    "introduced": "6.0.0"
                },
                {
                    "fixed": "6.2.6"
                },
                {
                    "fixed": "5.19.7"
                },
                {
                    "introduced": "6.0.0"
                },
                {
                    "fixed": "6.2.6"
                }
            ],
            "source": "DESCRIPTION"
        }
    ],
    "cwe_ids": [
        "CWE-285"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46605.json"
}
References

Affected packages

Git / github.com/apache/activemq

Affected ranges

Type
GIT
Repo
https://github.com/apache/activemq
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
fa56d21ff2d14b99928917cc0bef2e8830acf15f
Introduced
14bac13f40958c1a1d3d198051eed32facc4abd1
Fixed
bb9523b9847fe235a971256fec7ce6bb5670d14d
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "5.19.7"
        },
        {
            "introduced": "6.0.0"
        },
        {
            "fixed": "6.2.6"
        }
    ],
    "cpe": "cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*",
    "source": "CPE_RANGE"
}

Affected versions

activemq-5.*
activemq-5.10.0
activemq-5.11.0
activemq-5.12.0
activemq-5.13.0
activemq-5.14.0
activemq-5.15.0
activemq-5.16.0
activemq-5.18.0
activemq-5.18.1
activemq-5.18.2
activemq-5.18.3
activemq-5.18.4
activemq-5.18.5
activemq-5.18.6
activemq-5.19.0
activemq-5.19.1
activemq-5.19.2
activemq-5.9.0
activemq-6.*
activemq-6.0.0
activemq-6.1.0
activemq-6.1.1
activemq-6.1.2
activemq-6.2.0
activemq-6.2.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-46605.json"