Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Apache ActiveMQ lets attackers bypass permissions with crafted names

CVE-2026-108500 · published today
Summary

If you run Apache ActiveMQ with LDAP authorization enabled, an attacker who can log in can create or refer to a queue or topic using a specially crafted name. That name tricks the LDAP lookup and can give the attacker rights they should not have. Update ActiveMQ to the latest release (6.4.0, 6.3.3, or 5.19.12) to fix the problem.

What to do
  • Update apache software foundation apache activemq to version 6.3.3 or later.
Affected software
VendorProductAffected versions
apache software foundation apache activemq < 6.3.3
Original advisory text
Apache ActiveMQ: LDAPAuthorizationMap allows authorization bypass via DN injection
Input validation vulnerability in Apache ActiveMQ configured to use the LDAPAuthorizationMapPlugin allows an authenticated attacker to create or address a destination with a crafted name containing LDAP DN special characters (such as comma, plus, equals, backslash) can manipulate the LDAP search base used for ACL lookups.



This issue affects Apache ActiveMQ: from 6.3.0 before 6.3.3, from 5.19.0 before 5.19.12.



Users are recommended to upgrade to version 6.4.0, 6.3.3 or 5.19.12, which fixes the issue.
References
Type
CWE-20Improper Input Validation
Timeline
Published4 Nov 2026
Updated4 Nov 2026
First seen4 Nov 2026
Sources
CVE-2026-108500 · NVD
CVE-2026-108500 · MITRE
Track software like this
Free during beta