Apache ActiveMQ CVE-2026-108500

Exploitation requires that the ActiveMQ broker is explicitly configured with the LDAPAuthorizationMapPlugin for authorization (a non-default configuration), and that the attacker can authenticate to the broker and create or address destinations. The concrete trigger is a destination name containing LDAP DN special characters (comma, plus, equals, backslash) that perturbs the LDAP search base used for ACL lookups. Limiting factors: deployments not using LDAP-based authorization are not affected; the attacker needs existing broker access (the advisory describes an authenticated attacker, though no CVSS vector confirms the privilege level); and only the 6.3.0-6.3.2 and 5.19.0-5.19.11 ranges are in scope (6.4.0 unaffected).

This is a moderate-severity authorization-bypass flaw whose real-world priority is conditional rather than broad. Key decision signals are largely absent: there is no CVSS vector, no EPSS score, no CISA KEV listing, and no POC/exploit reference in the provided data (the vuln.today Decision label is 'awaiting_data'), so this cannot be treated as an active-exploitation emergency. The vendor rates it Moderate, and the defining constraint is architectural - it only applies when ActiveMQ is explicitly configured to use the LDAPAuthorizationMapPlugin, which is not the default authorization backend. The advisory text describes an 'authenticated attacker', but because no CVSS vector is supplied, the privilege requirement cannot be independently confirmed from the standard metrics - verify authentication level with the vendor advisory. Net assessment: a genuine but gated integrity/confidentiality concern (ACL bypass within the broker) for the subset of deployments using LDAP-based authorization, not a high-urgency internet-wide issue. Patch during normal maintenance for affected branches; treat as elevated priority specifically where LDAPAuthorizationMapPlugin is in use.

In a broker configured with the LDAPAuthorizationMapPlugin, an attacker who already has broker access creates or addresses a destination (queue/topic) whose name embeds LDAP DN special characters such as comma, plus, equals, or backslash. These characters alter the LDAP search base used for ACL lookups, letting the attacker influence which authorization rules are matched and bypass the intended access controls. No public exploit code or PoC reference is present in the supplied data.