UBUNTU-CVE-2026-111822

    Dashboard / Vulnerabilities / UBUNTU-CVE-2026-111822

    UBUNTU-CVE-2026-111822

    Published: 4 Nov 2026Last Modified: 5 Nov 2026
    Upstream:
    CVE-2026-111822

    Summary:

    Details: Improper invalidation of cached authorizations vulnerability in Apache ActiveMQ, Apache ActiveMQ Runtime Config. After the runtime configuration plugin removes a principal's write grant on a destination, an authenticated connection opened before the change can keep sending to that destination, including through a new anonymous producer, while fresh connections and new explicit producers are denied. This issue affects Apache ActiveMQ: from 6.0.0 before 6.3.3, before 5.19.12; Apache ActiveMQ Runtime Config: from 6.0.0 before 6.3.3, before 5.19.12. Users are recommended to upgrade to version 6.4.0, 6.3.3 or 5.19.12, which fixes the issue.

    References: https://ubuntu.com/security/CVE-2026-111822, https://www.cve.org/CVERecord?id=CVE-2026-111822, https://lists.apache.org/thread/b5gop0kwsm4sr1pgdrfcd14q8hx942j5

    Affected packages

    Package

    Name: activemq

    Purl: pkg:deb/ubuntu/activemq?arch=source&distro=esm-apps%2Fxenial

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -None

    Affected versions

    5.6.0+dfsg1-4+deb8u1ubuntu1
    5.6.0+dfsg1-5

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    UBUNTU-CVE-2026-111822 | CVE-DB