Apache Artemis vulnerabilities

CVE-2026-27446 [CRITICAL] CWE-306 CVE-2026-27446: Missing Authentication for Critical Function (CWE-306) vulnerability in Apache Artemis, Apache Activ Missing Authentication for Critical Function (CWE-306) vulnerability in Apache Artemis, Apache ActiveMQ Artemis. An unauthenticated remote attacker can use the Core protocol to force a target broker to establish an outbound Core federation connection to an attacker-controlled rogue broker. This could potentially result in message injection into an

CVE-2023-50780 [HIGH] CWE-285 CVE-2023-50780: Apache ActiveMQ Artemis allows access to diagnostic information and controls through MBeans, which a Apache ActiveMQ Artemis allows access to diagnostic information and controls through MBeans, which are also exposed through the authenticated Jolokia endpoint. Before version 2.29.0, this also included the Log4J2 MBean. This MBean is not meant for exposure to non-administrative users. This could eventually allow an authenticated attacker to write arbi

CVE-2026-57967 [CRITICAL] CWE-306 CVE-2026-57967: An unauthenticated remote attacker can craft a CORE protocol SESSION_REATTACH packet to steal an exi An unauthenticated remote attacker can craft a CORE protocol SESSION_REATTACH packet to steal an existing session and assume ongoing execution of the previously authenticated session. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0. Users are recommended to upgrade to version 2.

CVE-2026-49364 [CRITICAL] CWE-306 CVE-2026-49364: An unauthenticated network-adjacent attacker can leverage discovery to capture cluster administrativ An unauthenticated network-adjacent attacker can leverage discovery to capture cluster administrative credentials during the initial cluster connection handshake. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0. Users are recommended to upgrade to version 2.57.0, which fixes the

CVE-2026-67593 [CRITICAL] CWE-306 CVE-2026-67593: A remote attacker can craft an Openwire RemoveSubscriptionInfo command to cause the deletion of a qu A remote attacker can craft an Openwire RemoveSubscriptionInfo command to cause the deletion of a queue on the Artemis broker before the connection authentication and authorization stage or at any time thereafter. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0. Users are recomm

CVE-2021-26117 [HIGH] CWE-287 CVE-2021-26117: The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server. In this case, for Apache ActiveMQ Artemis prior to version 2.16.0 and Apache ActiveMQ prior to versions 5.16.1 and 5.15.14, the anonymous context is used to verify a valid users password in error, resulting in no check on the password.

CVE-2026-49363 [HIGH] CWE-306 CVE-2026-49363: An unauthenticated remote attacker connecting with the CORE protocol can discover cluster node detai An unauthenticated remote attacker connecting with the CORE protocol can discover cluster node details by sending a SUBSCRIBE_TOPOLOGY request prior to authentication. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0. Users are recommended to upgrade to version 2.57.0, which fixes th

CVE-2016-4978 [HIGH] CWE-502 CVE-2016-4978: The getObject method of the javax.jms.ObjectMessage class in the (1) JMS Core client, (2) Artemis br The getObject method of the javax.jms.ObjectMessage class in the (1) JMS Core client, (2) Artemis broker, and (3) Artemis REST component in Apache ActiveMQ Artemis before 1.4.0 might allow remote authenticated users with permission to send messages to the Artemis broker to deserialize arbitrary objects and execute arbitrary code by leveraging gadget cla

CVE-2026-49362 [HIGH] CWE-306 CVE-2026-49362: An unauthenticated remote attacker can create arbitrary durable queues via the CORE protocol, leadin An unauthenticated remote attacker can create arbitrary durable queues via the CORE protocol, leading to unauthorized broker state manipulation and potential denial of service. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0. Users are recommended to upgrade to version 2.57.0, which

CVE-2021-26118 [HIGH] CWE-284 CVE-2021-26118: While investigating ARTEMIS-2964 it was found that the creation of advisory messages in the OpenWire While investigating ARTEMIS-2964 it was found that the creation of advisory messages in the OpenWire protocol head of Apache ActiveMQ Artemis 2.15.0 bypassed policy based access control for the entire session. Production of advisory messages was not subject to access control in error.

CVE-2022-23913 [HIGH] CWE-770 CVE-2022-23913: In Apache ActiveMQ Artemis prior to 2.20.0 or 2.19.1, an attacker could partially disrupt availabili In Apache ActiveMQ Artemis prior to 2.20.0 or 2.19.1, an attacker could partially disrupt availability (DoS) through uncontrolled resource consumption of memory.

CVE-2017-12174 [HIGH] CWE-400 CVE-2017-12174: It was found that when Artemis and HornetQ before 2.4.0 are configured with UDP discovery and JGroup It was found that when Artemis and HornetQ before 2.4.0 are configured with UDP discovery and JGroups discovery a huge byte array is created when receiving an unexpected multicast message. This may result in a heap memory exhaustion, full GC, or OutOfMemoryError.

CVE-2026-57822 [MEDIUM] CWE-502 CVE-2026-57822: When the broker is processing message-based management requests, sent by an authenticated messaging When the broker is processing message-based management requests, sent by an authenticated messaging client that is authorized with MANAGE permission to perform management-via-messaging, the parameter processing can trigger Java deserialization of certain method parameters that the broker will not utilise. The permitted types allow to craft a payload

CVE-2026-75880 [MEDIUM] CWE-1333 CVE-2026-75880: An authenticated client could attach a consumer with a selector containing crafted wildcard usage th An authenticated client could attach a consumer with a selector containing crafted wildcard usage that results in excessive evaluation during message delivery attempts, occupying a shared broker thread and leading to denial of service. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0

CVE-2025-27391 [MEDIUM] CWE-532 CVE-2025-27391: Insertion of Sensitive Information into Log File vulnerability in Apache ActiveMQ Artemis. All the v Insertion of Sensitive Information into Log File vulnerability in Apache ActiveMQ Artemis. All the values of the broker properties are logged when the org.apache.activemq.artemis.core.config.impl.ConfigurationImpl logger has the debug level enabled. This issue affects Apache ActiveMQ Artemis: from 1.5.1 before 2.40.0. It can be mitigated by restric

CVE-2020-13932 [MEDIUM] CWE-79 CVE-2020-13932: In Apache ActiveMQ Artemis 2.5.0 to 2.13.0, a specially crafted MQTT packet which has an XSS payload In Apache ActiveMQ Artemis 2.5.0 to 2.13.0, a specially crafted MQTT packet which has an XSS payload as client-id or topic name can exploit this vulnerability. The XSS payload is being injected into the admin console's browser. The XSS payload is triggered in the diagram plugin; queue node and the info section.

CVE-2021-4040 [MEDIUM] CWE-400 CVE-2021-4040: A flaw was found in AMQ Broker. This issue can cause a partial interruption to the availability of A A flaw was found in AMQ Broker. This issue can cause a partial interruption to the availability of AMQ Broker via an Out of memory (OOM) condition. This flaw allows an attacker to partially disrupt availability to the broker through a sustained attack of maliciously crafted messages. The highest threat from this vulnerability is system availability.

CVE-2022-35278 [MEDIUM] CWE-80 CVE-2022-35278: In Apache ActiveMQ Artemis prior to 2.24.0, an attacker could show malicious content and/or redirect In Apache ActiveMQ Artemis prior to 2.24.0, an attacker could show malicious content and/or redirect users to a malicious URL in the web console by using HTML in the name of an address or queue.

CVE-2020-10727 [MEDIUM] CWE-312 CVE-2020-10727: A flaw was found in ActiveMQ Artemis management API from version 2.7.0 up until 2.12.0, where a user A flaw was found in ActiveMQ Artemis management API from version 2.7.0 up until 2.12.0, where a user inadvertently stores passwords in plaintext in the Artemis shadow file (etc/artemis-users.properties file) when executing the `resetUsers` operation. A local attacker can use this flaw to read the contents of the Artemis shadow file.

CVE-2026-32642 [MEDIUM] CWE-863 CVE-2026-32642: Incorrect Authorization (CWE-863) vulnerability in Apache Artemis, Apache ActiveMQ Artemis exists wh Incorrect Authorization (CWE-863) vulnerability in Apache Artemis, Apache ActiveMQ Artemis exists when an application using the OpenWire protocol attempts to create a non-durable JMS topic subscription on an address that doesn't exist with an authenticated user which has the "createDurableQueue" permission but does not have the "createAddress" permi