CVE-2026-46605
Last modified
CVE-2026-46605 is a medium-severity vulnerability rated 4.3/10 on the CVSS scale. Incomplete authorization by Apache ActiveMQ server before versions v6.2.6 and v5.19.7 allows authenticated connections to remove existing destinations with proper permissions. This issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ All: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6. Users are recommended to upgrade to version v6.2.6 or v5.19.7, which fixes the issue.. EPSS estimates a 0.34% chance of exploitation in the next 30 days.
Description
Incomplete authorization by Apache ActiveMQ server before versions v6.2.6 and v5.19.7 allows authenticated connections to remove existing destinations with proper permissions. This issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ All: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6. Users are recommended to upgrade to version v6.2.6 or v5.19.7, which fixes the issue.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Apache | Activemq | < 5.19.7 |
| Apache | Activemq | >= 6.0.0, < 6.2.6 |
| Apache | Activemq Broker | < 5.19.7 |
| Apache | Activemq Broker | >= 6.0.0, < 6.2.6 |
References
- https://lists.apache.org/thread/l4lxgr2s73g9pb218f180psfyskf8ldmMailing List, Vendor Advisory
- http://www.openwall.com/lists/oss-security/2026/05/31/20Mailing List, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-46605?
How severe is CVE-2026-46605?
How do I fix CVE-2026-46605?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-46599The TIFF decoder does not place a limit on the size of PackB…7.5
- CVE-2026-4660HashiCorp’s go-getter library up to v1.8.5 may allow arbitra…7.5
- CVE-2026-46600Parsing an invalid SVCB or HTTPS RR can panic when the size …7.5
- CVE-2026-46601The webp decoder can panic when processing a VP8 chunk with …7.5
- CVE-2026-46602The TIFF decoder does not set a limit on the size of tiles i…7.5
- CVE-2026-46604The TIFF decoder can panic when decoding an invalid image wi…7.5
- CVE-2026-46606Glances is an open-source system cross-platform monitoring t…7.8
- CVE-2026-46607Glances is an open-source system cross-platform monitoring t…7.8
- CVE-2026-46608Glances is an open-source system cross-platform monitoring t…7.4
- CVE-2026-46609Umbraco is an ASP.NET CMS. From version 14.0.0 to before ver…4.6
- CVE-2026-4661The WP CTA – Sticky CTA Builder, Generate Leads, Promote Sal…7.5
- CVE-2026-46611Glances is an open-source system cross-platform monitoring t…5.3
Are you affected by CVE-2026-46605?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST