Cyber ·
CVE-2026-111822: Apache ActiveMQ keeps write access after ACL revocation
A cached authorization invalidation flaw in Apache ActiveMQ may keep write permission after its dynamic revocation. The advisory says to update to fixed versions 6.3.3 or 5.19.12.
On November 3, 2026, Christopher L. Shannon published advisory CVE-2026-111822 on the oss-sec feed, rated important severity. According to the automatically translated text, the flaw is improper invalidation of cached authorizations in Apache ActiveMQ and Apache ActiveMQ Runtime Config: after the runtime configuration plugin removes a identity's write permission on a destination, access may remain valid. Affected versions are 6.0.0 before 6.3.3 and those before 5.19.12, in both components.
The advisory recommends updating to a fixed version. To verify, consult the original advisory on the seclists oss-sec feed by searching for identifier CVE-2026-111822, and confirm the version list in the official Apache project notes. For environments running ActiveMQ, the practical action is to inventory installations and Runtime Config components, update them, and test whether write revocations take effect immediately. The source text is truncated; do not assume details beyond those listed here.