Title: Apache ActiveMQ de Apache Software Foundation, Description: Autorización incompleta por el servidor Apache ActiveMQ antes de las versiones v6.2.6 y v5.19.7 permite que las conexiones autenticadas eliminen destinos existentes con los permisos adecuados.

Este problema afecta a Apache ActiveMQ Broker: antes de 5.19.7, desde 6.0.0 antes de 6.2.6; Apache ActiveMQ All: antes de 5.19.7, desde 6.0.0 antes de 6.2.6; Apache ActiveMQ: antes de 5.19.7, desde 6.0.0 antes de 6.2.6.

Se recomienda a los usuarios actualizar a la versión v6.2.6 o v5.19.7, que corrige el problema.

{"timestamp":"2026-06-01T14:44:45.455019Z","id":"CVE-2026-46605","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"Apache Software Foundation","product":"Apache ActiveMQ Broker","defaultStatus":"unaffected","collectionURL":"https://repo.maven.apache.org/maven2","packageName":"org.apache.activemq:activemq-broker","versions":[{"version":"0","lessThan":"5.19.7","versionType":"semver","status":"affected"},{"version":"6.0.0","lessThan":"6.2.6","versionType":"semver","status":"affected"}]},{"vendor":"Apache Software Foundation","product":"Apache ActiveMQ All","defaultStatus":"unaffected","collectionURL":"https://repo.maven.apache.org/maven2","packageName":"org.apache.activemq:activemq-all","versions":[{"version":"0","lessThan":"5.19.7","versionType":"semver","status":"affected"},{"version":"6.0.0","lessThan":"6.2.6","versionType":"semver","status":"affected"}]},{"vendor":"Apache Software Foundation","product":"Apache ActiveMQ","defaultStatus":"unaffected","collectionURL":"https://repo.maven.apache.org/maven2","packageName":"org.apache.activemq:apache-activemq","versions":[{"version":"0","lessThan":"5.19.7","versionType":"semver","status":"affected"},{"version":"6.0.0","lessThan":"6.2.6","versionType":"semver","status":"affected"}]}]

OR
          *cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:* versions up to (excluding) 5.19.7
          *cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:* versions from (including) 6.0.0 up to (excluding) 6.2.6
          *cpe:2.3:a:apache:activemq_broker:*:*:*:*:*:*:*:* versions up to (excluding) 5.19.7
          *cpe:2.3:a:apache:activemq_broker:*:*:*:*:*:*:*:* versions from (including) 6.0.0 up to (excluding) 6.2.6

Apache Software Foundation: https://lists.apache.org/thread/l4lxgr2s73g9pb218f180psfyskf8ldm Types: Mailing List, Vendor Advisory

CVE: http://www.openwall.com/lists/oss-security/2026/05/31/20 Types: Mailing List, Third Party Advisory

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

http://www.openwall.com/lists/oss-security/2026/05/31/20

Incomplete authorization by Apache ActiveMQ server before versions v6.2.6 and v5.19.7 allows authenticated connections to remove existing destinations with proper permissions.

This issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ All: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6.

Users are recommended to upgrade to version v6.2.6 or v5.19.7, which fixes the issue.

CWE-285

https://lists.apache.org/thread/l4lxgr2s73g9pb218f180psfyskf8ldm