CVE-2026-27446
published 2026-03-04CVE-2026-27446: Missing Authentication for Critical Function (CWE-306) vulnerability in Apache Artemis, Apache ActiveMQ Artemis. An unauthenticated remote attacker can use the…
PriorityP273critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
10.63%
95.3th percentile
Missing Authentication for Critical Function (CWE-306) vulnerability in Apache Artemis, Apache ActiveMQ Artemis. An unauthenticated remote attacker can use the Core protocol to force a target broker to establish an outbound Core federation connection to an attacker-controlled rogue broker. This could potentially result in message injection into any queue and/or message exfiltration from any queue via the rogue broker. This impacts environments that allow both:
- incoming Core protocol connections from untrusted sources to the broker
- outgoing Core protocol connections from the broker to untrusted targets
This issue affects:
- Apache Artemis from 2.50.0 through 2.51.0
- Apache ActiveMQ Artemis from 2.11.0 through 2.44.0.
Users are recommended to upgrade to Apache Artemis version 2.52.0, which fixes the issue.
The issue can be mitigated by one of the following:
- Remove Core protocol support from any acceptor receiving connections from untrusted sources. Incoming Core protocol connections are supported by default via the "artemis" acceptor listening on port 61616. See the "protocols" URL parameter configured for the acceptor. An acceptor URL without this parameter supports all protocols by default, including Core.
- Use two-way SSL (i.e. certificate-based authentication) in order to force every client to present the proper SSL certificate when establishing a connection before any message protocol handshake is attempted. This will prevent unauthenticated exploitation of this vulnerability.
- Implement and deploy a Core interceptor to deny all Core downstream federation connect packets. Such packets have a type of (int) -16 or (byte) 0xfffffff0. Documentation for interceptors is available at https://artemis.apache.org/components/artemis/documentation/latest/intercepting-operations.html .
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | artemis | — | — |
| apache | artemis | 2.11.0 – 2.44.0 | — |
| knime | knime_business_hub | >= 0.0.0 < 1.15.2 | 1.15.2 |
| knime | knime_business_hub | >= 1.16.0 < 1.16.3 | 1.16.3 |
| knime | knime_business_hub | >= 1.17.0 < 1.17.4 | 1.17.4 |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
0xfffffff0 (type byte) / -16 (type int) — Core downstream federation connect packet
- →Monitor for unexpected outbound Core federation connections from the broker to untrusted/external targets — this is the primary exploitation mechanism where an attacker forces the broker to connect to an attacker-controlled rogue broker. ↗
- →Deploy a Core interceptor to detect and deny Core downstream federation connect packets identified by packet type (int) -16 or (byte) 0xfffffff0 on the broker. ↗
- →Alert on unauthenticated Core protocol connections arriving on port 61616 (the default 'artemis' acceptor), especially those triggering federation handshakes without prior authentication. ↗
- →In KNIME Business Hub environments, watch for low-privileged users registering federated mirrors against the internal Apache Artemis instance without authentication, which would indicate exploitation of CVE-2026-4649 (the KNIME-specific variant). ↗
- ·The vulnerability only affects environments that permit BOTH incoming Core protocol connections from untrusted sources AND outgoing Core protocol connections to untrusted targets. Environments that restrict either direction are not exploitable via this path. ↗
- ·The default 'artemis' acceptor on port 61616 supports all protocols including Core if no 'protocols' URL parameter is set — this is the default attack surface configuration. ↗
- ·Affected version ranges differ between the two artifact groups: Apache Artemis (org.apache.artemis:artemis-server) 2.50.0–2.51.0 and Apache ActiveMQ Artemis (org.apache.activemq:artemis-server) 2.11.0–2.44.0. Ensure the correct artifact coordinates are checked during inventory. ↗
- ·In KNIME Business Hub, Apache Artemis is not externally exposed, so exploitation requires at minimum a legitimate user account with workflow execution privileges — pure external unauthenticated exploitation is not possible in that deployment. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.09.3CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
osv9.3CRITICAL
vendor_redhat9.3CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2026-4649: Apache Artemis before version 2
osv·2026-03-24·CVSS 9.3
CVE-2026-4649 [CRITICAL] CVE-2026-4649: Apache Artemis before version 2
Apache Artemis before version 2.52.0 is affected by an authentication bypass flaw which allows reading all messages exchanged via the broker and injection of new message ( CVE-2026-27446 https://www.cve.org/CVERecord ). Since KNIME Business Hub uses Apache Artemis it is also affected by the issue. However, since Apache Artemis is not exposed to the outside it requires at least normal user privileges and the ability to execute workflows in an executor. Such a user can install and register a federated mirror without authentication to the original Apache Artemis instance and thereby read all internal messages and inject new messages. The issue affects all versions of KNIME Business Hub. A fixed version of Apache Artemis is shipped with versions 1.18.0, 1.17.4, and 1.16.3. We recommend updatin
GHSA
GHSA-c27m-9j97-3ghp: Apache Artemis before version 2
ghsa_unreviewed·2026-03-24·CVSS 9.3
CVE-2026-4649 [CRITICAL] CWE-306 GHSA-c27m-9j97-3ghp: Apache Artemis before version 2
Apache Artemis before version 2.52.0 is affected by an authentication bypass flaw which allows reading all messages exchanged via the broker and injection of new message ( CVE-2026-27446 https://www.cve.org/CVERecord ). Since KNIME Business Hub uses Apache Artemis it is also affected by the issue. However, since Apache Artemis is not exposed to the outside it requires at least normal user privileges and the ability to execute workflows in an executor. Such a user can install and register a federated mirror without authentication to the original Apache Artemis instance and thereby read all internal messages and inject new messages.
The issue affects all versions of KNIME Business Hub. A fixed version of Apache Artemis is shipped with versions 1.18.0, 1.17.4, and 1.16.3.
We recommend updat
OSV
Apache Artemis and Apache ActiveMQ Artemis are Missing Authentication for Critical Functions
osv·2026-03-04
CVE-2026-27446 [CRITICAL] Apache Artemis and Apache ActiveMQ Artemis are Missing Authentication for Critical Functions
Apache Artemis and Apache ActiveMQ Artemis are Missing Authentication for Critical Functions
Missing Authentication for Critical Function (CWE-306) vulnerability in Apache Artemis, Apache ActiveMQ Artemis. An unauthenticated remote attacker can use the Core protocol to force a target broker to establish an outbound Core federation connection to an attacker-controlled rogue broker. This could potentially result in message injection into any queue and/or message exfiltration from any queue via the rogue broker. This impacts environments that allow both:
- Incoming Core protocol connections from untrusted sources to the broker
- Outgoing Core protocol connections from the broker to untrusted targets
This issue affects:
- Apache Artemis from 2.50.0 through 2.51.0
- Apache ActiveMQ Artemi
GHSA
Apache Artemis and Apache ActiveMQ Artemis are Missing Authentication for Critical Functions
ghsa·2026-03-04
CVE-2026-27446 [CRITICAL] CWE-306 Apache Artemis and Apache ActiveMQ Artemis are Missing Authentication for Critical Functions
Apache Artemis and Apache ActiveMQ Artemis are Missing Authentication for Critical Functions
Missing Authentication for Critical Function (CWE-306) vulnerability in Apache Artemis, Apache ActiveMQ Artemis. An unauthenticated remote attacker can use the Core protocol to force a target broker to establish an outbound Core federation connection to an attacker-controlled rogue broker. This could potentially result in message injection into any queue and/or message exfiltration from any queue via the rogue broker. This impacts environments that allow both:
- Incoming Core protocol connections from untrusted sources to the broker
- Outgoing Core protocol connections from the broker to untrusted targets
This issue affects:
- Apache Artemis from 2.50.0 through 2.51.0
- Apache ActiveMQ Artemi
OSV
CVE-2026-27446: Missing Authentication for Critical Function (CWE-306) vulnerability in Apache Artemis, Apache ActiveMQ Artemis
osv·2026-03-04·CVSS 9.3
CVE-2026-27446 [CRITICAL] CVE-2026-27446: Missing Authentication for Critical Function (CWE-306) vulnerability in Apache Artemis, Apache ActiveMQ Artemis
Missing Authentication for Critical Function (CWE-306) vulnerability in Apache Artemis, Apache ActiveMQ Artemis. An unauthenticated remote attacker can use the Core protocol to force a target broker to establish an outbound Core federation connection to an attacker-controlled rogue broker. This could potentially result in message injection into any queue and/or message exfiltration from any queue via the rogue broker. This impacts environments that allow both: - incoming Core protocol connections from untrusted sources to the broker - outgoing Core protocol connections from the broker to untrusted targets This issue affects: - Apache Artemis from 2.50.0 through 2.51.0 - Apache ActiveMQ Artemis from 2.11.0 through 2.44.0. Users are recommended to upgrade to Apache Artemis version 2.52.0, wh
Red Hat
Apache Artemis: KNIME Business Hub: Apache Artemis and KNIME Business Hub: Authentication bypass allows information disclosure and message injection.
vendor_redhat·2026-03-24·CVSS 9.3
CVE-2026-4649 [CRITICAL] CWE-306 Apache Artemis: KNIME Business Hub: Apache Artemis and KNIME Business Hub: Authentication bypass allows information disclosure and message injection.
Apache Artemis: KNIME Business Hub: Apache Artemis and KNIME Business Hub: Authentication bypass allows information disclosure and message injection.
Apache Artemis before version 2.52.0 is affected by an authentication bypass flaw which allows reading all messages exchanged via the broker and injection of new message ( CVE-2026-27446 https://www.cve.org/CVERecord ). Since KNIME Business Hub uses Apache Artemis it is also affected by the issue. However, since Apache Artemis is not exposed to the outside it requires at least normal user privileges and the ability to execute workflows in an executor. Such a user can install and register a federated mirror without authentication to the original Apache Artemis instance and thereby read all internal messages and inject new messages.
The issue
Red Hat
org.apache.artemis:artemis-server: org.apache.activemq:artemis-server: Apache Artemis, Apache ActiveMQ Artemis: Message injection and exfiltration due to missing authentication
vendor_redhat·2026-03-04·CVSS 9.3
CVE-2026-27446 [CRITICAL] CWE-306 org.apache.artemis:artemis-server: org.apache.activemq:artemis-server: Apache Artemis, Apache ActiveMQ Artemis: Message injection and exfiltration due to missing authentication
org.apache.artemis:artemis-server: org.apache.activemq:artemis-server: Apache Artemis, Apache ActiveMQ Artemis: Message injection and exfiltration due to missing authentication
Missing Authentication for Critical Function (CWE-306) vulnerability in Apache Artemis, Apache ActiveMQ Artemis. An unauthenticated remote attacker can use the Core protocol to force a target broker to establish an outbound Core federation connection to an attacker-controlled rogue broker. This could potentially result in message injection into any queue and/or message exfiltration from any queue via the rogue broker. This impacts environments that allow both:
- incoming Core protocol connections from untrusted sources to the broker
- outgoing Core protocol connections from the broker to untrusted targets
This issu
No detection rules found.
No public exploits indexed.
Wiz
CVE-2026-27446 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 9.3
CVE-2026-27446 [CRITICAL] CVE-2026-27446 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-27446 :
Java vulnerability analysis and mitigation
Missing Authentication for Critical Function (CWE-306) vulnerability in Apache Artemis, Apache ActiveMQ Artemis. An unauthenticated remote attacker can use the Core protocol to force a target broker to establish an outbound Core federation connection to an attacker-controlled rogue broker. This could potentially result in message injection into any queue and/or message exfiltration from any queue via the rogue broker. This impacts environments that allow both:
incoming Core protocol connections from untrusted sources to the broker
outgoing Core protocol connections from the broker to untrusted targets
This issue affects:
Apache Artemis from 2.50.0 through 2.51.0
Apache ActiveMQ Artemis from 2.11.0 through 2.44.0.
Users
Bugzilla
CVE-2026-27446 org.apache.artemis:artemis-server: org.apache.activemq:artemis-server: Apache Artemis, Apache ActiveMQ Artemis: Message injection and exfiltration due to missing authentication
bugzilla·2026-03-04·CVSS 9.3
CVE-2026-27446 [CRITICAL] CVE-2026-27446 org.apache.artemis:artemis-server: org.apache.activemq:artemis-server: Apache Artemis, Apache ActiveMQ Artemis: Message injection and exfiltration due to missing authentication
CVE-2026-27446 org.apache.artemis:artemis-server: org.apache.activemq:artemis-server: Apache Artemis, Apache ActiveMQ Artemis: Message injection and exfiltration due to missing authentication
Affected versions:
- Apache Artemis (org.apache.artemis:artemis-server) 2.50.0 through 2.51.0
- Apache ActiveMQ Artemis (org.apache.activemq:artemis-server) 2.11.0 through 2.44.0
Description:
Missing Authentication for Critical Function (CWE-306) vulnerability in Apache Artemis, Apache ActiveMQ Artemis. An unauthenticated remote attacker can use the Core protocol to force a target broker to establish an outbound Core federation connection to an attacker-controlled rogue broker. This could potentially result in message injection into any queue and/or message exfiltration from any queue via the rogu
https://lists.apache.org/thread/jwpsdc8tdxotm98od8n8n30fqlzoc8gghttp://www.openwall.com/lists/oss-security/2026/03/03/4http://www.openwall.com/lists/oss-security/2026/03/04/1https://access.redhat.com/errata/RHSA-2026:17668https://access.redhat.com/errata/RHSA-2026:18054https://access.redhat.com/errata/RHSA-2026:18055https://access.redhat.com/errata/RHSA-2026:18059https://access.redhat.com/errata/RHSA-2026:3955https://access.redhat.com/errata/RHSA-2026:3957https://access.redhat.com/security/cve/CVE-2026-27446https://bugzilla.redhat.com/show_bug.cgi?id=2444320https://cert-portal.siemens.com/productcert/html/ssa-085541.htmlhttps://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27446.json
2026-03-04
Published