CVE-2026-74761

Overview

Apache ActiveMQ Classic is an open-source Java message broker that provides asynchronous messaging for applications. It supports JMS 1.1 and multiple wire protocols, including OpenWire, AMQP, MQTT and STOMP. Broker and client components are published as Maven artifacts under org.apache.activemq. ActiveMQ Classic is distinct from Apache ActiveMQ Artemis, which has its own broker implementation and release lines.

An authorization bypass vulnerability (CVE-2026-74761) has been identified in the Apache ActiveMQ Classic broker's durable topic subscription handling, which allows an authenticated client to spoof the clientId in a remove-subscription request and delete a durable topic subscription that belongs to a different client.

Per OWASP: Access control, sometimes called authorization, is how a web application grants access to content and functions to some users and not others. These checks are performed after authentication, and govern what 'authorized' users are allowed to do.

This issue affects multiple versions of Apache ActiveMQ Classic.

‍

Details

Module Info

• Product: Apache ActiveMQ Classic
• Affected packages: org.apache.activemq:activemq-broker, org.apache.activemq:activemq-all, org.apache.activemq:apache-activemq
• Affected versions: <5.19.11, >=6.0.0 <6.3.2
• GitHub repository: https://github.com/apache/activemq
• Published packages: https://central.sonatype.com/artifact/org.apache.activemq/activemq-broker, https://central.sonatype.com/artifact/org.apache.activemq/activemq-all, https://central.sonatype.com/artifact/org.apache.activemq/apache-activemq
• Package manager: Maven
• Fixed in:
  • OSS Apache ActiveMQ Classic 5.19.11, 6.3.2
  • NES for ActiveMQ v5.16.11

Vulnerability Info

This High-severity vulnerability is found in the org.apache.activemq:activemq-broker package in multiple versions of Apache ActiveMQ Classic. When a client removes a durable topic subscription, it sends a RemoveSubscriptionInfo command that carries a clientId and a subscription name. The broker's TopicRegion.removeSubscription method builds the lookup key for the durable subscription directly from the clientId supplied in that command:

@Override
public void removeSubscription(ConnectionContext context, RemoveSubscriptionInfo info) throws Exception {
    SubscriptionKey key = new SubscriptionKey(info.getClientId(), info.getSubscriptionName());
    DurableTopicSubscription sub = durableSubscriptions.get(key);
    if (sub == null) {
        throw new InvalidDestinationException("No durable subscription exists for clientID: " +
                                              info.getClientId() + " and subscriptionName: " +
                                              info.getSubscriptionName());
    }
    if (sub.isActive()) {
        throw new JMSException("Durable consumer is in use");
    } else {
        durableSubscriptions.remove(key);
    }
    ...
}

The clientId in RemoveSubscriptionInfo is never compared with the clientId the broker already associates with the sending connection through its ConnectionContext. An authenticated client can therefore craft a remove-subscription command that names another client's clientId and subscription name. If that durable subscription is inactive, the broker removes it and deletes it from every matching topic, so the owning client loses that durable subscription.

‍

Mitigation

Inactive versions of Apache ActiveMQ Classic are End-of-Life and will not receive updates to address this issue. For more information, see here.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to a currently supported release of Apache ActiveMQ Classic that contains the fix.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• Wanxin Yin (finder)