Missing Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. Apache ActiveMQ Classic temporary destinations are expected to be isolated to the connection that created them. The isolation can be broken as this is only checked in the client, allowing a different connection to consume from another connection's temporary destination. This issue affects Apache ActiveMQ Broker: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7. Users are recommended to upgrade to version 6.2.7, which fixes the issue.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Missing Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ.
    Apache ActiveMQ Classic temporary destinations are expected to be isolated to the connection that created
    them. The isolation can be broken as this is only checked in the client, allowing a different connection
    to consume from another connection's temporary destination. This issue affects Apache ActiveMQ Broker:
    before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7;
    Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7. Users are recommended to upgrade to version
    6.2.7, which fixes the issue. (CVE-2026-54475)

The version of Apache ActiveMQ running on the remote host is prior to 5.19.8 or 6.x prior to 6.2.7. It is, therefore, affected by multiple vulnerabilities:

  - Improper Input Validation vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp. A remote     unauthenticated peer that can reach an exposed STOMP connector can trigger denial-of-service behavior by sending a     negative content-length. For the NIO STOMP transport, an attacker can keep streaming body bytes and grow the     per-connection command buffer beyond configured limits to cause OOM. For the blocking STOMP protocol, an error will     instead force abnormal transport exception handling for the affected connection and closure. (CVE-2026-49432)

  - Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ Client, Apache ActiveMQ, Apache     ActiveMQ All. An unauthenticated network attacker can cause a broker DoS by sending a crafted WireFormatInfo frame     with a malicious large size value. The value is not validated and causes the broker to attempt allocation during     pre-auth negotiation which can trigger OOM and crash the broker. (CVE-2026-50734)

  - Improper Authorization vulnerability in Apache ActiveMQ. An authenticated low-privilege Web Console user by default     can access /admin/* paths in the Web Console. The default Jetty settings incorrectly did not limit those paths to     only admins. (CVE-2026-49877)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Missing Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ.
    Apache ActiveMQ Classic temporary destinations are expected to be isolated to the connection that created     them. The isolation can be broken as this is only checked in the client, allowing a different connection     to consume from another connection's temporary destination. This issue affects Apache ActiveMQ Broker:
    before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7;
    Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7. Users are recommended to upgrade to version     6.2.7, which fixes the issue. (CVE-2026-54475)

  - Missing Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ.Apache     ActiveMQ temporary destinations are expected to be isolated to the connection that created them. The     isolation can be broken as this is only checked in the client, allowing a different connection to consume     from another connection's temporarydestination.This issue affects Apache ActiveMQ Broker: before 5.19.8,     from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ:
    before 5.19.8, from 6.0.0 before 6.2.7.Users are recommended to upgrade to version 6.2.7, which fixes the     issue. (CVE-2026-54475)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
478570	SCA: security update for org.apache.activemq:activemq-all, org.apache.activemq:activemq-broker, org.apache.activemq:apache-activemq (GHSA-mhp6-f224-j2c3)	Tenable Cloud Security	SCA Checks	Local	high
478570	SCA: security update for org.apache.activemq:activemq-all, org.apache.activemq:activemq-broker, org.apache.activemq:apache-activemq (GHSA-mhp6-f224-j2c3)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
324953	Apache ActiveMQ < 5.19.8 / 6.x < 6.2.7 Multiple Vulnerabilities	Nessus	CGI abuses	Combined	high
324252	Linux Distros Unpatched Vulnerability : CVE-2026-54475	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-54475

high

Tenable Plugins

high

high

high

high