CVE-2026-46605 Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incomplete authorization during destination removal
Authenticated users can improperly remove existing destinations due to incomplete authorization checks in Apache ActiveMQ.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-46605?
CVE-2026-46605 is a medium-severity missing authorization vulnerability in Apache Activemq, published on 1 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Incomplete authorization by Apache ActiveMQ server before versions v6.2.6 and v5.19.7 allows authenticated connections to remove existing destinations with proper permissions.
This issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ All: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6.
Users are recommended to upgrade to version v6.2.6 or v5.19.7, which fixes the issue.
Weakness: CWE-285
Which versions are affected by CVE-2026-46605?
5 open source packages ship an affected version, including org.apache.activemq:apache-activemq and activemq. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.activemq:apache-activemq Maven | All versions | 5.19.7 |
org.apache.activemq:apache-activemq Maven | All versions | 5.19.7 |
org.apache.activemq:apache-activemq Maven | From 6.0.0 | 6.2.6 |
org.apache.activemq:apache-activemq Maven | From 6.0.0 | 6.2.6 |
activemq Bitnami | All versions | 5.19.7, 6.2.6 |
Products include Apache Activemq, Apache Activemq Broker.
How do I fix CVE-2026-46605?
Upgrade org.apache.activemq:apache-activemq to a fixed version for your release line: 5.19.7 or 6.2.6.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-46605 being exploited?
There is no known exploitation of CVE-2026-46605 in the wild and no public exploit code.
Other vulnerabilities in Apache Activemq
Sources
Also known as BIT-activemq-2026-46605, DEBIAN-CVE-2026-46605, GHSA-cpw7-g3p5-qrfq, MINI-32xg-ffpj-2j2g, MINI-9r62-p5xr-888m, MINI-gh74-r2cv-7h2r and 2 more.