CVE-2025-27391: Apache ActiveMQ Artemis: Passwords leaking from broker properties in the debug log
Insertion of Sensitive Information into Log File vulnerability in Apache ActiveMQ Artemis. All the values of the broker properties are logged when the org.apache.activemq.artemis.core.config.impl.ConfigurationImpl logger has the debug level enabled.
This issue affects Apache ActiveMQ Artemis: from 1.5.1 before 2.40.0. It can be mitigated by restricting log access to only trusted users.
Users are recommended to upgrade to version 2.40.0, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.apache.activemq:artemis-projectto a version that resolves this vulnerability.Fixed in 2.40.0 - Configuration
Disable the DEBUG log level for the org.apache.activemq.artemis.core.config.impl.ConfigurationImpl logger to prevent broker property values (including passwords) from being written to logs.
org.apache.activemq.artemis.core.config.impl.ConfigurationImpl logger log level = disable DEBUG - Compensating control
Restrict access to broker logs to only trusted users to mitigate exposure of sensitive information.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-27391?
CVE-2025-27391 has a medium severity level due to the risk of sensitive information being exposed in log files.
How do I fix CVE-2025-27391?
To fix CVE-2025-27391, disable debug logging for the org.apache.activemq.artemis.core.config.impl.ConfigurationImpl logger.
What versions of Apache ActiveMQ Artemis are affected by CVE-2025-27391?
CVE-2025-27391 affects Apache ActiveMQ Artemis versions from 1.5.1 to 2.40.0 inclusive.
What type of information is compromised in CVE-2025-27391?
CVE-2025-27391 compromises broker property values that are logged when debug logging is enabled.
Is there a workaround for CVE-2025-27391 if I cannot upgrade?
As a workaround for CVE-2025-27391, consider temporarily disabling or restricting debug logging to prevent sensitive information from being logged.