Apache Software Foundation Apache Activemq Artemis vulnerabilities

CVE-2026-32642 [LOW] CWE-863 CVE-2026-32642: Incorrect Authorization (CWE-863) vulnerability in Apache Artemis, Apache ActiveMQ Artemis exists wh Incorrect Authorization (CWE-863) vulnerability in Apache Artemis, Apache ActiveMQ Artemis exists when an application using the OpenWire protocol attempts to create a non-durable JMS topic subscription on an address that doesn't exist with an authenticated user which has the "createDurableQueue" permission but does not have the "createAddress" permissi

CVE-2026-27446 [CRITICAL] CWE-306 Apache Artemis, Apache ActiveMQ Artemis: Auth bypass for Core downstream federation Apache Artemis, Apache ActiveMQ Artemis: Auth bypass for Core downstream federation Missing Authentication for Critical Function (CWE-306) vulnerability in Apache Artemis, Apache ActiveMQ Artemis. An unauthenticated remote attacker can use the Core protocol to force a target broker to establish an outbound Core federation connection to an attacker-controlled rogue broker. This c

CVE-2025-27391 [MEDIUM] CWE-532 CVE-2025-27391: Insertion of Sensitive Information into Log File vulnerability in Apache ActiveMQ Artemis. All the v Insertion of Sensitive Information into Log File vulnerability in Apache ActiveMQ Artemis. All the values of the broker properties are logged when the org.apache.activemq.artemis.core.config.impl.ConfigurationImpl logger has the debug level enabled. This issue affects Apache ActiveMQ Artemis: from 1.5.1 before 2.40.0. It can be mitigated by restric

CVE-2025-27427 [LOW] CWE-863 CVE-2025-27427: A vulnerability exists in Apache ActiveMQ Artemis whereby a user with the createDurableQueue or crea A vulnerability exists in Apache ActiveMQ Artemis whereby a user with the createDurableQueue or createNonDurableQueue permission on an address can augment the routing-type supported by that address even if said user doesn't have the createAddress permission for that particular address. When combined with the send permission and automatic queue creation

CVE-2023-50780 [HIGH] CWE-285 CVE-2023-50780: Apache ActiveMQ Artemis allows access to diagnostic information and controls through MBeans, which a Apache ActiveMQ Artemis allows access to diagnostic information and controls through MBeans, which are also exposed through the authenticated Jolokia endpoint. Before version 2.29.0, this also included the Log4J2 MBean. This MBean is not meant for exposure to non-administrative users. This could eventually allow an authenticated attacker to write arbi

CVE-2022-35278 [MEDIUM] CWE-80 CVE-2022-35278: In Apache ActiveMQ Artemis prior to 2.24.0, an attacker could show malicious content and/or redirect In Apache ActiveMQ Artemis prior to 2.24.0, an attacker could show malicious content and/or redirect users to a malicious URL in the web console by using HTML in the name of an address or queue.

CVE-2022-23913 [HIGH] CWE-770 CVE-2022-23913: In Apache ActiveMQ Artemis prior to 2.20.0 or 2.19.1, an attacker could partially disrupt availabili In Apache ActiveMQ Artemis prior to 2.20.0 or 2.19.1, an attacker could partially disrupt availability (DoS) through uncontrolled resource consumption of memory.

CVE-2021-26118 [HIGH] CWE-284 CVE-2021-26118: While investigating ARTEMIS-2964 it was found that the creation of advisory messages in the OpenWire While investigating ARTEMIS-2964 it was found that the creation of advisory messages in the OpenWire protocol head of Apache ActiveMQ Artemis 2.15.0 bypassed policy based access control for the entire session. Production of advisory messages was not subject to access control in error.