CVE-2026-27446
CriticalCVSS 9.8Exploitation Probability (EPSS)
Very high risk95th percentile - higher than 95% of all known CVEs
Summary
Missing Authentication for Critical Function (CWE-306) vulnerability in Apache Artemis and Apache ActiveMQ Artemis. An unauthenticated remote attacker can use the Core protocol to force a target broker to establish an outbound Core federation connection to an attacker-controlled rogue broker. This could potentially result in message injection into any queue and/or message exfiltration from any queue via the rogue broker.
Risk Assessment
The risk for the organization includes unauthorized access to message queues, potentially leading to data theft or injection of malicious content, compromising the confidentiality and integrity of messaging systems.
Recommendation
It is recommended to upgrade immediately to Apache Artemis version 2.52.0. If upgrading is not possible, apply one of the mitigations: remove Core protocol support from the acceptor, implement two-way SSL authentication, or deploy a Core interceptor to block federation packets of type -16.
Other vulnerabilities in Apache Artemis
See all- CVE-2026-67593Critical
A remote attacker can craft an Openwire RemoveSubscriptionInfo command to cause the deletion of a queue on the Artemis broker before the connection authentication and authorization stage or at any time thereafter. The issue affects Apache Artemis 2.50.0 through 2.56.0 and Apache ActiveMQ Artemis 1.0.0 through 2.44.0.
- CVE-2026-57967Critical
An unauthenticated remote attacker can craft a CORE protocol SESSION_REATTACH packet to steal an existing session and assume ongoing execution of the previously authenticated session. The issue affects Apache Artemis 2.50.0 through 2.56.0 and Apache ActiveMQ Artemis 1.0.0 through 2.44.0.
- CVE-2026-49364Critical
An unauthenticated network-adjacent attacker can leverage discovery to capture cluster administrative credentials during the initial cluster connection handshake. The issue affects Apache Artemis 2.50.0 through 2.56.0 and Apache ActiveMQ Artemis 1.0.0 through 2.44.0.
- CVE-2026-75880Medium
An authenticated client can attach a consumer with a selector containing crafted wildcard usage, causing excessive evaluation during message delivery attempts. This occupies a shared broker thread and leads to denial of service. The issue affects Apache Artemis 2.50.0 through 2.56.0 and Apache ActiveMQ Artemis 1.0.0 through 2.44.0.
- CVE-2026-57822Medium
When the broker processes message-based management requests sent by an authenticated messaging client authorized with MANAGE permission, parameter processing can trigger Java deserialization of certain method parameters the broker will not use. The permitted types allow crafting a payload that causes excessive computation and pins the processing thread, leading to denial of service. The issue affects Apache Artemis 2.50.0 through 2.56.0 and Apache ActiveMQ Artemis 1.3.0 through 2.44.0.
- CVE-2026-49363High
An unauthenticated remote attacker connecting with the CORE protocol can discover cluster node details by sending a SUBSCRIBE_TOPOLOGY request prior to authentication. The issue affects Apache Artemis 2.50.0 through 2.56.0 and Apache ActiveMQ Artemis 1.0.0 through 2.44.0.
- CVE-2026-49362High
An unauthenticated remote attacker can create arbitrary durable queues via the CORE protocol, leading to unauthorized broker state manipulation and potential denial of service. The issue affects Apache Artemis 2.50.0 through 2.56.0 and Apache ActiveMQ Artemis 1.0.0 through 2.44.0.
Original NVD description (English source)
Missing Authentication for Critical Function (CWE-306) vulnerability in Apache Artemis, Apache ActiveMQ Artemis. An unauthenticated remote attacker can use the Core protocol to force a target broker to establish an outbound Core federation connection to an attacker-controlled rogue broker. This could potentially result in message injection into any queue and/or message exfiltration from any queue via the rogue broker. This impacts environments that allow both: - incoming Core protocol connections from untrusted sources to the broker - outgoing Core protocol connections from the broker to untrusted targets This issue affects: - Apache Artemis from 2.50.0 through 2.51.0 - Apache ActiveMQ Artemis from 2.11.0 through 2.44.0. Users are recommended to upgrade to Apache Artemis version 2.52.0, which fixes the issue. The issue can be mitigated by one of the following: - Remove Core protocol support from any acceptor receiving connections from untrusted sources. Incoming Core protocol connections are supported by default via the "artemis" acceptor listening on port 61616. See the "protocols" URL parameter configured for the acceptor. An acceptor URL without this parameter supports all protocols by default, including Core. - Use two-way SSL (i.e. certificate-based authentication) in order to force every client to present the proper SSL certificate when establishing a connection before any message protocol handshake is attempted. This will prevent unauthenticated exploitation of this vulnerability. - Implement and deploy a Core interceptor to deny all Core downstream federation connect packets. Such packets have a type of (int) -16 or (byte) 0xfffffff0. Documentation for interceptors is available at https://artemis.apache.org/components/artemis/documentation/latest/intercepting-operations.html .
Vulnerability data from NVD (NIST) · CISA KEV · EPSS