« Volver al listado

CVE-2026-46605

Estado: AnalizadaMedia (4.3)—

Incomplete authorization by Apache ActiveMQ server before versions v6.2.6 and v5.19.7 allows authenticated connections to remove existing destinations with proper permissions.

This issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ All: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6.

Users are recommended to upgrade to version v6.2.6 or v5.19.7, which fixes the issue.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Apache — ActivemqApache — Activemq Broker

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-46605",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-46605",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-06-01T14:44:45.455019Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@apache.org",
      "affectedData": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache ActiveMQ Broker",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "5.19.7",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "6.0.0",
              "lessThan": "6.2.6",
              "versionType": "semver"
            }
          ],
          "packageName": "org.apache.activemq:activemq-broker",
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache ActiveMQ All",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "5.19.7",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "6.0.0",
              "lessThan": "6.2.6",
              "versionType": "semver"
            }
          ],
          "packageName": "org.apache.activemq:activemq-all",
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache ActiveMQ",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "5.19.7",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "6.0.0",
              "lessThan": "6.2.6",
              "versionType": "semver"
            }
          ],
          "packageName": "org.apache.activemq:apache-activemq",
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-06-01T09:16:19.827",
  "references": [
    {
      "url": "https://lists.apache.org/thread/l4lxgr2s73g9pb218f180psfyskf8ldm",
      "tags": [
        "Mailing List",
        "Vendor Advisory"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2026/05/31/20",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@apache.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-285"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Incomplete authorization by Apache ActiveMQ server before versions v6.2.6 and v5.19.7 allows authenticated connections to remove existing destinations with proper permissions.\n\nThis issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ All: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6.\n\nUsers are recommended to upgrade to version v6.2.6 or v5.19.7, which fixes the issue."
    },
    {
      "lang": "es",
      "value": "Autorización incompleta por el servidor Apache ActiveMQ antes de las versiones v6.2.6 y v5.19.7 permite que las conexiones autenticadas eliminen destinos existentes con los permisos adecuados.\n\nEste problema afecta a Apache ActiveMQ Broker: antes de 5.19.7, desde 6.0.0 antes de 6.2.6; Apache ActiveMQ All: antes de 5.19.7, desde 6.0.0 antes de 6.2.6; Apache ActiveMQ: antes de 5.19.7, desde 6.0.0 antes de 6.2.6.\n\nSe recomienda a los usuarios actualizar a la versión v6.2.6 o v5.19.7, que corrige el problema."
    }
  ],
  "lastModified": "2026-07-22T07:10:00.107",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "793E68E6-9024-4518-B062-42B2DE5BB555",
              "versionEndExcluding": "5.19.7"
            },
            {
              "criteria": "cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FFF44DB9-1850-4B5F-AD0F-55CB5219AB22",
              "versionEndExcluding": "6.2.6",
              "versionStartIncluding": "6.0.0"
            },
            {
              "criteria": "cpe:2.3:a:apache:activemq_broker:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FE27E832-0E65-4D05-A2EE-271152799E96",
              "versionEndExcluding": "5.19.7"
            },
            {
              "criteria": "cpe:2.3:a:apache:activemq_broker:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "94F0DB6E-BEF4-4BEB-92F5-3A7B65172CC2",
              "versionEndExcluding": "6.2.6",
              "versionStartIncluding": "6.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@apache.org"
}