ActiveMQ (6.3.0 - 6.3.2) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/activemq-6.3.0---6.3.2/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 03 Nov 2026 22:15:25 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgApache ActiveMQ: LDAPAuthorizationMap authorization bypass (CVE-2026-108500)https://feed.craftedsignal.io/briefs/2026-11-apache-activemq-ldap-bypass/Tue, 03 Nov 2026 22:15:25 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-apache-activemq-ldap-bypass/An input validation vulnerability in the LDAPAuthorizationMapPlugin allows authenticated attackers to bypass authorization controls via crafted destination names containing LDAP DN special characters.Apache ActiveMQ is vulnerable to an authorization bypass issue (CVE-2026-108500) within the LDAPAuthorizationMapPlugin. An authenticated attacker can exploit this by creating or addressing a message destination using a name containing specific LDAP Distinguished Name (DN) special characters, such as commas, plus signs, equals signs, or backslashes. This allows the attacker to circumvent established authorization policies, potentially accessing or creating destinations they are not permitted to manage.

Impact

Successful exploitation allows an authenticated attacker to bypass authorization constraints within the broker, leading to unauthorized message destination creation or access.

Recommendation

  • Identify and inventory all Apache ActiveMQ instances running affected versions (6.3.0 through 6.3.2, or 5.19.0 through 5.19.11).
  • Upgrade Apache ActiveMQ 6.3.x instances to version 6.3.3 or later.
  • Upgrade Apache ActiveMQ 5.19.x instances to version 5.19.12 or later.
  • Review ActiveMQ audit logs for unexpected creation or interaction with destinations containing LDAP special characters (e.g., symbols like '+' or ',').
]]>mediumadvisoryvulnerabilityactivemqldap