CVE-2026-54475

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-54475
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54475.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-54475
Aliases
Downstream
Published
2026-06-30T09:48:28.852Z
Modified
2026-07-15T01:49:14.528691890Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Temporary destination ownership takeover
Details

Missing Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ.

Apache ActiveMQ Classic temporary destinations are expected to be isolated to the connection that created them. The isolation can be broken as this is only checked in the client, allowing a different connection to consume from another connection's temporary destination. This issue affects Apache ActiveMQ Broker: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7.

Users are recommended to upgrade to version 6.2.7, which fixes the issue.

Database specific 
{
    "cwe_ids": [
        "CWE-862"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54475.json",
    "cna_assigner": "apache",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "fixed": "5.19.8"
                },
                {
                    "introduced": "6.0.0"
                },
                {
                    "fixed": "6.2.7"
                },
                {
                    "fixed": "5.19.8"
                },
                {
                    "introduced": "6.0.0"
                },
                {
                    "fixed": "6.2.7"
                },
                {
                    "fixed": "5.19.8"
                },
                {
                    "introduced": "6.0.0"
                },
                {
                    "fixed": "6.2.7"
                }
            ]
        },
        {
            "source": "DESCRIPTION",
            "extracted_events": [
                {
                    "fixed": "5.19.8"
                },
                {
                    "introduced": "6.0.0"
                },
                {
                    "fixed": "6.2.7"
                },
                {
                    "fixed": "5.19.8"
                },
                {
                    "introduced": "6.0.0"
                },
                {
                    "fixed": "6.2.7"
                },
                {
                    "fixed": "5.19.8"
                },
                {
                    "introduced": "6.0.0"
                },
                {
                    "fixed": "6.2.7"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/apache/activemq

Affected ranges

Type
GIT
Repo
https://github.com/apache/activemq
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
7d56ebc8e04dd0a2a14545cfa05883f9bdba72a2
Introduced
14bac13f40958c1a1d3d198051eed32facc4abd1
Fixed
f3e61919b374ee5b124f80458334c314fc2cb29d
Database specific 
{
    "cpe": "cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*",
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "5.19.8"
        },
        {
            "introduced": "6.0.0"
        },
        {
            "fixed": "6.2.7"
        }
    ]
}

Affected versions

activemq-5.*
activemq-5.10.0
activemq-5.11.0
activemq-5.12.0
activemq-5.13.0
activemq-5.14.0
activemq-5.15.0
activemq-5.16.0
activemq-5.18.0
activemq-5.18.1
activemq-5.18.2
activemq-5.18.3
activemq-5.18.4
activemq-5.18.5
activemq-5.18.6
activemq-5.19.0
activemq-5.19.1
activemq-5.19.2
activemq-5.9.0
activemq-6.*
activemq-6.0.0
activemq-6.1.0
activemq-6.1.1
activemq-6.1.2
activemq-6.2.0
activemq-6.2.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54475.json"