Apache ActiveMQ keeps write access after ACL revocation (CVE-2026-111822)

What happened and what to do

The advisory, published on 3 November by Christopher L. Shannon on the oss-sec list, rates the flaw as important. It affects Apache ActiveMQ 6.0.0 before 6.3.3, Apache ActiveMQ before 5.19.12, and the Runtime Config components in the same version ranges. According to the description, after the runtime configuration plugin removes an identity's write permission on a destination, the old authorization can remain in effect because the cache is not properly invalidated.

In practice, a company running ActiveMQ with dynamic access control may believe it has revoked access while writes are still accepted. The response starts with an inventory of instances, versions and use of the Runtime Config plugin, followed by upgrading to 6.3.3 or 5.19.12. Because revocation depends on runtime behavior, it is worth building an automated test that revokes a test identity's permission, attempts a publish and confirms rejection, run in staging before and after the upgrade. Monitoring write logs from revoked identities and defining a revocation procedure that verifies its effect, rather than relying only on the configuration change, also helps.

How the consultancy can help

We can run a diagnosis of the exposure: an inventory of ActiveMQ instances and Runtime Config use, revocation tests and analysis of write logs. We then design and implement the upgrade plan, automated revocation tests and continuous monitoring on your infrastructure.

Next step

If your company runs ActiveMQ with dynamic access control, send a short description of your setup, including the versions in use and how permissions are changed. We will reply with a scoped proposal for diagnosis and implementation.