Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-06-30T09:48:28 org.apache.activemq/activemq-broker: org.apache.activemq/activemq-all: org.apache.activemq/activemq: Apache ActiveMQ: Information disclosure due to broken temporary destination isolation 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L CWE-1220

Missing Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. Apache ActiveMQ Classic temporary destinations are expected to be isolated to the connection that created them. The isolation can be broken as this is only checked in the client, allowing a different connection to consume from another connection's temporary destination. This issue affects Apache ActiveMQ Broker: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7. Users are recommended to upgrade to version 6.2.7, which fixes the issue.

A flaw was found in Apache ActiveMQ. Temporary destinations, which are designed to be private to a specific connection, can be accessed by other connections due to a missing authorization check. This allows an unauthorized connection to consume messages from another connection's temporary destination, leading to information disclosure.

Red Hat products ship Apache ActiveMQ Classic components as transitive dependencies. The vulnerability is in the Classic ActiveMQ broker's temporary destination isolation, where access control is enforced only client-side, allowing a different connection to consume messages from another connection's temporary destination. Red Hat AMQ Broker is based on Apache ActiveMQ Artemis, which has its own temporary destination implementation. The Classic broker's temporary destination logic is not exercised at runtime in Red Hat product deployments. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Red Hat AMQ Broker 7 Not affected activemq-broker Red Hat Data Grid 8 Not affected activemq-broker Red Hat Enterprise Linux 8 Not affected log4j:2/log4j Red Hat Fuse 7 Fix deferred activemq-all Red Hat Fuse 7 Fix deferred activemq-broker Red Hat JBoss Enterprise Application Platform Expansion Pack Not affected activemq-broker https://www.cve.org/CVERecord?id=CVE-2026-54475 https://nvd.nist.gov/vuln/detail/CVE-2026-54475 https://lists.apache.org/thread/85f3q7mkh71y7qwyn6wvgw0bw4jl06ys