Cyber ·
CVE-2026-108500: DN injection bypasses LDAP authorization in Apache ActiveMQ
Moderate-severity advisory on the Apache ActiveMQ LDAPAuthorizationMapPlugin: an authenticated user can use special DN characters in destination names to bypass LDAP authorization. Versions 6.3.x and 5.19.x are affected until the indicated fixes.
Advisory published on November 3, 2026 and identified as CVE-2026-108500, rated moderate, according to machine-translated material from the oss-sec feed, published by Matt Pavlovich. The issue is in the LDAPAuthorizationMapPlugin of Apache ActiveMQ, which maps authorizations through LDAP. An already authenticated attacker can create or access a destination with a crafted name containing special LDAP DN characters such as comma, plus sign, equals sign and backslash, and thereby bypass authorization. Affected versions are 6.3.0 before 6.3.3 and 5.19.0 before 5.19.12; 6.4.0 is stated as not affected. The text received is cut off before the full description of consequences, so no more can be claimed than what was stated. Relevance: if your organization runs ActiveMQ with this plugin, the main action is to check the installed version and apply the fix indicated by the project. Rota Nacional does not fix this product. To consult the original, use the reference given in the November 2026 oss-sec archive and confirm versions and mitigations in the official Apache advisories. If you use AI to study this advisory, do not paste real destination names, LDAP configurations, internal hosts or credentials. Rota's personal-data detection covers types such as CPF, CNPJ, e-mail, phone and person names, but internal technical identifiers must be removed manually before sending.