Skip to content
Threat Feed
Subscribe
medium advisory

Apache ActiveMQ: LDAPAuthorizationMap authorization bypass (CVE-2026-108500)

An input validation vulnerability in the LDAPAuthorizationMapPlugin allows authenticated attackers to bypass authorization controls via crafted destination names containing LDAP DN special characters.

CVE search metadata

CVE search record: CVE-2026-108500. KEV: no. Product: ActiveMQ (6.3.0 - 6.3.2), ActiveMQ (5.19.0 - 5.19.11). Brief: Apache ActiveMQ: LDAPAuthorizationMap authorization bypass (CVE-2026-108500). Brief link: https://feed.craftedsignal.io/briefs/2026-11-apache-activemq-ldap-bypass/

Triage facts

Revision 1
Applicability
ActiveMQ (6.3.0 - 6.3.2), ActiveMQ (5.19.0 - 5.19.11)
Evidence
Unknown
Severity
Medium
Action
Elevated
Sources
1 public source
Freshness
Revision 1Nov 3, 22:15 UTC
Vulnerabilities
1 CVE
Source quality
A1Likely

Apache ActiveMQ is vulnerable to an authorization bypass issue (CVE-2026-108500) within the LDAPAuthorizationMapPlugin. An authenticated attacker can exploit this by creating or addressing a message destination using a name containing specific LDAP Distinguished Name (DN) special characters, such as commas, plus signs, equals signs, or backslashes. This allows the attacker to circumvent established authorization policies, potentially accessing or creating destinations they are not permitted to manage.

Impact

Successful exploitation allows an authenticated attacker to bypass authorization constraints within the broker, leading to unauthorized message destination creation or access.

Recommendation

  • Identify and inventory all Apache ActiveMQ instances running affected versions (6.3.0 through 6.3.2, or 5.19.0 through 5.19.11).
  • Upgrade Apache ActiveMQ 6.3.x instances to version 6.3.3 or later.
  • Upgrade Apache ActiveMQ 5.19.x instances to version 5.19.12 or later.
  • Review ActiveMQ audit logs for unexpected creation or interaction with destinations containing LDAP special characters (e.g., symbols like '+' or ',').

Immediate actions

Upgrade vulnerable ActiveMQ installations to version 6.3.3 or 5.19.12

IT Operations 72h

Threat Hunt

Monitor ActiveMQ broker logs for administrative actions or destination creation requests containing LDAP metacharacters

T1068 medium medium confidence hunt now

Data: ActiveMQ application logs, Audit logs for JMX/Web console operations

Mitigations

Upgrade to 6.3.3 or 5.19.12

immediate IT Operations

CVE-2026-108500