CVE-2026-111822

— UNSCORED

Published 2026-11-04 · Updated 2026-11-04

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Improper invalidation of cached authorizations vulnerability in Apache ActiveMQ, Apache ActiveMQ Runtime Config. After the runtime configuration plugin removes a principal's write grant on a destination, an authenticated connection opened before the change can keep sending to that destination, including through a new anonymous producer, while fresh connections and new explicit producers are denied. This issue affects Apache ActiveMQ: from 6.0.0 before 6.3.3, before 5.19.12; Apache ActiveMQ Runtime Config: from 6.0.0 before 6.3.3, before 5.19.12. Users are recommended to upgrade to version 6.4.0, 6.3.3 or 5.19.12, which fixes the issue.

All references

https://lists.apache.org/thread/b5gop0kwsm4sr1pgdrfcd14q8hx942j5
http://www.openwall.com/lists/oss-security/2026/11/03/20

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.