CVE-2021-26118
published 2021-01-27CVE-2021-26118: While investigating ARTEMIS-2964 it was found that the creation of advisory messages in the OpenWire protocol head of Apache ActiveMQ Artemis 2.15.0 bypassed…
PriorityP345high7.5CVSS 3.1
AVNACLPRNUINSUCNIHAN
EPSS
4.01%
89.4th percentile
While investigating ARTEMIS-2964 it was found that the creation of advisory messages in the OpenWire protocol head of Apache ActiveMQ Artemis 2.15.0 bypassed policy based access control for the entire session. Production of advisory messages was not subject to access control in error.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | artemis | — | — |
| apache_software_foundation | apache_activemq_artemis | >= unspecified < 2.16.0 | 2.16.0 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
osv7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Apache ActiveMQ Artemis vulnerable to Improper Access Control
osv·2021-06-16
CVE-2021-26118 [HIGH] Apache ActiveMQ Artemis vulnerable to Improper Access Control
Apache ActiveMQ Artemis vulnerable to Improper Access Control
While investigating ARTEMIS-2964 it was found that the creation of advisory messages in the OpenWire protocol head of Apache ActiveMQ Artemis 2.15.0 bypassed policy based access control for the entire session. Production of advisory messages was not subject to access control in error.
GHSA
Apache ActiveMQ Artemis vulnerable to Improper Access Control
ghsa·2021-06-16
CVE-2021-26118 [HIGH] CWE-284 Apache ActiveMQ Artemis vulnerable to Improper Access Control
Apache ActiveMQ Artemis vulnerable to Improper Access Control
While investigating ARTEMIS-2964 it was found that the creation of advisory messages in the OpenWire protocol head of Apache ActiveMQ Artemis 2.15.0 bypassed policy based access control for the entire session. Production of advisory messages was not subject to access control in error.
OSV
CVE-2021-26118: While investigating ARTEMIS-2964 it was found that the creation of advisory messages in the OpenWire protocol head of Apache ActiveMQ Artemis 2
osv·2021-01-27·CVSS 7.5
CVE-2021-26118 [HIGH] CVE-2021-26118: While investigating ARTEMIS-2964 it was found that the creation of advisory messages in the OpenWire protocol head of Apache ActiveMQ Artemis 2
While investigating ARTEMIS-2964 it was found that the creation of advisory messages in the OpenWire protocol head of Apache ActiveMQ Artemis 2.15.0 bypassed policy based access control for the entire session. Production of advisory messages was not subject to access control in error.
Red Hat
7: OpenWire can create destinations with an unpriviledged user
vendor_redhat·2020-10-28·CVSS 7.5
CVE-2021-26118 [HIGH] CWE-285 7: OpenWire can create destinations with an unpriviledged user
7: OpenWire can create destinations with an unpriviledged user
While investigating ARTEMIS-2964 it was found that the creation of advisory messages in the OpenWire protocol head of Apache ActiveMQ Artemis 2.15.0 bypassed policy based access control for the entire session. Production of advisory messages was not subject to access control in error.
A flaw was found in AMQ 7 broker, where it allows users using the OpenWire protocol to bypass the usual permissions checks. This flaw allows an unprivileged user to create queues without verifying the role. The highest threat from this vulnerability is to integrity.
Mitigation: If you are not using the openwire protocol, it can be disabled by removing it from the list of accepted protocols in the `broker.xml`
```xml
tcp://0.0.0.0:61616?tcpSendB
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2021-26118 AMQ Broker 7: OpenWire can create destinations with an unpriviledged user
bugzilla·2020-10-28·CVSS 7.5
CVE-2021-26118 [HIGH] CVE-2021-26118 AMQ Broker 7: OpenWire can create destinations with an unpriviledged user
CVE-2021-26118 AMQ Broker 7: OpenWire can create destinations with an unpriviledged user
It was found that the AMQ 7 broker allows users using the OpenWire protocol to bypass usual permissions checks, this can allow an unprivileged user to create queues without verifying the role.
Discussion:
Acknowledgments:
Name: Francesco Marchioni (Red Hat)
---
Mitigation:
If you are not using the openwire protocol, it can be disabled by removing it from the list of accepted protocols in the `broker.xml`
```xml
tcp://0.0.0.0:61616?tcpSendBufferSize=1048576;tcpReceiveBufferSize=1048576;amqpMinLargeMessageSize=102400;protocols=CORE,AMQP,STOMP,HORNETQ,MQTT;useEpoll=true;amqpCredits=1000;amqpLowCredits=300;amqpDuplicateDetection=true
```
arXiv
Propagation-Based Vulnerability Impact Assessment for Software Supply Chains
arxiv_fulltext·2025-10-09
Propagation-Based Vulnerability Impact Assessment for Software Supply Chains
Propagation-Based Vulnerability Impact Assessment for Software Supply Chains
Bonan Ruan 0.3cm
Zhiwei Lin 0.3cm
Jiahao Liu10.3cm
Chuqi Zhang 0.3cm
Kaihang Ji 0.3cm
Zhenkai Liang
National University of Singapore
\r-bonan, zhiweil, jiahao99, chuqiz, kaihang, liangzk\@comp.nus.edu.sg
1Corresponding author
## Abstract
Identifying the impact scope and scale is critical for software supply chain vulnerability assessment.
However, existing studies face substantial limitations.
First, prior studies either work at coarse package-level granularity—producing many false positives—or fail to accomplish whole-ecosystem vulnerability propagation analysis.
Second, although vulnerability assessment indicators like CVSS characterize individual vulnerabilities, no metric exists to specifically quantify the
https://lists.apache.org/thread.html/rafd5d7cf303772a0118865262946586921a65ebd98fc24f56c812574%40%3Cannounce.apache.org%3Ehttps://mail-archives.apache.org/mod_mbox/activemq-users/202101.mbox/%3CCAH%2BvQmMUNnkiXv2-d3ucdErWOsdnLi6CgnK%2BVfixyJvTgTuYig%40mail.gmail.com%3Ehttps://security.netapp.com/advisory/ntap-20210827-0002/https://lists.apache.org/thread.html/rafd5d7cf303772a0118865262946586921a65ebd98fc24f56c812574%40%3Cannounce.apache.org%3Ehttps://mail-archives.apache.org/mod_mbox/activemq-users/202101.mbox/%3CCAH%2BvQmMUNnkiXv2-d3ucdErWOsdnLi6CgnK%2BVfixyJvTgTuYig%40mail.gmail.com%3Ehttps://security.netapp.com/advisory/ntap-20210827-0002/
2021-01-27
Published