CVE-2026-49364
UnknownSummary
An unauthenticated network-adjacent attacker can leverage discovery to capture cluster administrative credentials during the initial cluster connection handshake. The issue affects Apache Artemis 2.50.0 through 2.56.0 and Apache ActiveMQ Artemis 1.0.0 through 2.44.0.
Risk Assessment
Capturing cluster administrative credentials may allow an attacker to gain full control over the broker and its configuration. This poses a serious threat to the confidentiality and integrity of the messaging infrastructure.
Recommendation
Upgrade Apache Artemis / ActiveMQ Artemis to version 2.57.0, which fixes this issue. Securing cluster communication with encryption and network segmentation is also recommended.
Other vulnerabilities in Apache Artemis
See all- CVE-2026-75880Unknown
An authenticated client can attach a consumer with a selector containing crafted wildcard usage, causing excessive evaluation during message delivery attempts. This occupies a shared broker thread and leads to denial of service. The issue affects Apache Artemis 2.50.0 through 2.56.0 and Apache ActiveMQ Artemis 1.0.0 through 2.44.0.
- CVE-2026-67593Unknown
A remote attacker can craft an Openwire RemoveSubscriptionInfo command to cause the deletion of a queue on the Artemis broker before the connection authentication and authorization stage or at any time thereafter. The issue affects Apache Artemis 2.50.0 through 2.56.0 and Apache ActiveMQ Artemis 1.0.0 through 2.44.0.
- CVE-2026-57967Unknown
An unauthenticated remote attacker can craft a CORE protocol SESSION_REATTACH packet to steal an existing session and assume ongoing execution of the previously authenticated session. The issue affects Apache Artemis 2.50.0 through 2.56.0 and Apache ActiveMQ Artemis 1.0.0 through 2.44.0.
- CVE-2026-57822Unknown
When the broker processes message-based management requests sent by an authenticated messaging client authorized with MANAGE permission, parameter processing can trigger Java deserialization of certain method parameters the broker will not use. The permitted types allow crafting a payload that causes excessive computation and pins the processing thread, leading to denial of service. The issue affects Apache Artemis 2.50.0 through 2.56.0 and Apache ActiveMQ Artemis 1.3.0 through 2.44.0.
- CVE-2026-49363Unknown
An unauthenticated remote attacker connecting with the CORE protocol can discover cluster node details by sending a SUBSCRIBE_TOPOLOGY request prior to authentication. The issue affects Apache Artemis 2.50.0 through 2.56.0 and Apache ActiveMQ Artemis 1.0.0 through 2.44.0.
- CVE-2026-49362Unknown
An unauthenticated remote attacker can create arbitrary durable queues via the CORE protocol, leading to unauthorized broker state manipulation and potential denial of service. The issue affects Apache Artemis 2.50.0 through 2.56.0 and Apache ActiveMQ Artemis 1.0.0 through 2.44.0.
- CVE-2026-27446Critical
Missing Authentication for Critical Function (CWE-306) vulnerability in Apache Artemis and Apache ActiveMQ Artemis. An unauthenticated remote attacker can use the Core protocol to force a target broker to establish an outbound Core federation connection to an attacker-controlled rogue broker. This could potentially result in message injection into any queue and/or message exfiltration from any queue via the rogue broker.
Original NVD description (English source)
An unauthenticated network-adjacent attacker can leverage discovery to capture cluster administrative credentials during the initial cluster connection handshake. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0. Users are recommended to upgrade to version 2.57.0, which fixes the issue.