CVE-2026-108500

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-108500", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-10-10T01:59:11.050Z", "datePublished": "2026-11-04T10:37:55.532Z", "dateUpdated": "2026-11-12T19:13:25.426Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-11-04T10:37:55.532Z"}, "title": "Apache ActiveMQ: LDAPAuthorizationMap allows authorization bypass via DN injection", "problemTypes": [{"descriptions": [{"description": "CWE-20 Improper Input Validation", "lang": "en", "cweId": "CWE-20", "type": "CWE"}]}], "source": {"discovery": "EXTERNAL"}, "affected": [{"vendor": "Apache Software Foundation", "product": "Apache ActiveMQ", "versions": [{"status": "affected", "version": "6.3.0", "lessThan": "6.3.3", "versionType": "semver"}, {"status": "affected", "version": "5.19.0", "lessThan": "5.19.12", "versionType": "semver"}, {"status": "unaffected", "version": "6.4.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"value": "Input validation vulnerability in Apache ActiveMQ configured to use the LDAPAuthorizationMapPlugin allows\u00a0an authenticated attacker to\u00a0create or address a destination with a crafted name containing LDAP DN\u00a0special characters (such as comma, plus, equals, backslash) can manipulate\u00a0the LDAP search base used for ACL lookups.\n\n\n\nThis issue affects Apache ActiveMQ: from 6.3.0 before 6.3.3, from 5.19.0 before 5.19.12.\n\n\n\nUsers are recommended to upgrade to version 6.4.0, 6.3.3 or 5.19.12, which fixes the issue.", "lang": "en", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Input validation vulnerability in Apache ActiveMQ configured to use the LDAPAuthorizationMapPlugin allows&nbsp;<span>an authenticated attacker to</span><span>&nbsp;create or address a destination with a crafted name containing LDAP DN</span><span>&nbsp;special characters (such as comma, plus, equals, backslash) can manipulate</span><span>&nbsp;the LDAP search base used for ACL lookups.</span></p><p>This issue affects Apache ActiveMQ: from 6.3.0 before 6.3.3, from 5.19.0 before 5.19.12.</p><p>Users are recommended to upgrade to version 6.4.0, 6.3.3 or 5.19.12, which fixes the issue.</p>"}]}], "references": [{"url": "https://lists.apache.org/thread/0oh4k4ty6hv56d4sydjp26l95f4bsnxt", "tags": ["vendor-advisory"]}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "Moderate"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "credits": [{"lang": "en", "value": "Rishabh Soni (Azmendus) <rishabhv704@gmail.com>", "type": "finder"}], "x_generator": {"engine": "Vulnogram 1.0.3"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/11/03/16"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-11-04T11:10:16.981Z"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-11-10T12:35:16.564655Z", "id": "CVE-2026-108500", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-12T19:13:25.426Z"}}]}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Apache ActiveMQ", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "6.3.3", "status": "affected", "version": "6.3.0", "versionType": "semver"}, {"lessThan": "5.19.12", "status": "affected", "version": "5.19.0", "versionType": "semver"}, {"status": "unaffected", "version": "6.4.0", "versionType": "semver"}]}], "source": "security@apache.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Input validation vulnerability in Apache ActiveMQ configured to use the LDAPAuthorizationMapPlugin allows\u00a0an authenticated attacker to\u00a0create or address a destination with a crafted name containing LDAP DN\u00a0special characters (such as comma, plus, equals, backslash) can manipulate\u00a0the LDAP search base used for ACL lookups.\n\n\n\nThis issue affects Apache ActiveMQ: from 6.3.0 before 6.3.3, from 5.19.0 before 5.19.12.\n\n\n\nUsers are recommended to upgrade to version 6.4.0, 6.3.3 or 5.19.12, which fixes the issue."}], "id": "CVE-2026-108500", "lastModified": "2026-11-12T20:18:15.567", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-108500", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-10T12:35:16.564655Z", "version": "2.0.3"}}]}, "published": "2026-11-04T11:17:13.763", "references": [{"source": "security@apache.org", "url": "https://lists.apache.org/thread/0oh4k4ty6hv56d4sydjp26l95f4bsnxt"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/11/03/16"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "security@apache.org", "type": "Secondary"}]}

{"bugzilla": {"description": "org.apache.activemq/activemq-broker: Apache ActiveMQ: Authorization bypass via crafted destination names in LDAP plugin", "id": "2566836", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2566836"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-90", "details": ["Input validation vulnerability in Apache ActiveMQ configured to use the LDAPAuthorizationMapPlugin allows\u00a0an authenticated attacker to\u00a0create or address a destination with a crafted name containing LDAP DN\u00a0special characters (such as comma, plus, equals, backslash) can manipulate\u00a0the LDAP search base used for ACL lookups.\nThis issue affects Apache ActiveMQ: from 6.3.0 before 6.3.3, from 5.19.0 before 5.19.12.\nUsers are recommended to upgrade to version 6.4.0, 6.3.3 or 5.19.12, which fixes the issue.", "A flaw was found in Apache ActiveMQ when configured to use the LDAP authorization plugin (LDAPAuthorizationMapPlugin). An authenticated attacker can bypass access control restrictions by creating or addressing a destination with a specially crafted name containing Lightweight Directory Access Protocol (LDAP) special characters. This allows the attacker to manipulate the directory search base used for Access Control List (ACL) lookups, potentially gaining unauthorized access to restricted messaging resources."], "name": "CVE-2026-108500", "package_state": [{"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Out of support scope", "package_name": "activemq-broker", "product_name": "Red Hat Fuse 7"}], "public_date": "2026-11-04T10:37:55Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-108500\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-108500\nhttps://lists.apache.org/thread/0oh4k4ty6hv56d4sydjp26l95f4bsnxt"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.3.0,6.3.3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.19.0,5.19.12)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "6.4.0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Apache ActiveMQ", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "activemq", "vendor": "apache"}], "created": "2026-11-04T12:45:13.692115+00:00", "updated": "2026-11-06T01:30:10.870354+00:00", "vendors": ["apache", "apache$PRODUCT$activemq"], "weaknesses": ["CWE-20", "CWE-90"]}