CVE-2026-27446: Apache Artemis, Apache ActiveMQ Artemis: Auth bypass for Core downstream federation
Affected versions:
- Apache Artemis (org.apache.artemis:artemis-server) 2.50.0 through 2.51.0 - Apache ActiveMQ Artemis (org.apache.activemq:artemis-server) 2.11.0 through 2.44.0
Description:
Missing Authentication for Critical Function (CWE-306) vulnerability in Apache Artemis, Apache ActiveMQ Artemis. An unauthenticated remote attacker can use the Core protocol to force a target broker to establish an outbound Core federation connection to an attacker-controlled rogue broker. This could potentially result in message injection into any queue and/or message exfiltration from any queue via the rogue broker. This impacts environments that allow both:
- incoming Core protocol connections from untrusted sources to the broker
- outgoing Core protocol connections from the broker to untrusted targets
This issue affects:
- Apache Artemis from 2.50.0 through 2.51.0
- Apache ActiveMQ Artemis from 2.11.0 through 2.44.0.
Users are recommended to upgrade to Apache Artemis version 2.52.0, which fixes the issue.
The issue can be mitigated by either of the following:
- Remove Core protocol support from any acceptor receiving connections from untrusted sources. Incoming Core protocol connections are supported by default via the "artemis" acceptor listening on port 61616. See the "protocols" URL parameter configured for the acceptor. An acceptor URL without this parameter supports all protocols by default, including Core.
- Use two-way SSL (i.e. certificate-based authentication) in order to force every client to present the proper SSL certificate when establishing a connection before any message protocol handshake is attempted. This will prevent unauthenticated exploitation of this vulnerability.
Credit:
Hardik Mehta <me...> (finder)
References:
https://artemis.apache.org https://www.cve.org/CVERecord?id=CVE-2026-27446
Other sources
Missing Authentication for Critical Function (CWE-306) vulnerability in Apache Artemis, Apache ActiveMQ Artemis. An unauthenticated remote attacker can use the Core protocol to force a target broker to establish an outbound Core federation connection to an attacker-controlled rogue broker. This could potentially result in message injection into any queue and/or message exfiltration from any queue via the rogue broker. This impacts environments that allow both:
- incoming Core protocol connections from untrusted sources to the broker
- outgoing Core protocol connections from the broker to untrusted targets
This issue affects:
- Apache Artemis from 2.50.0 through 2.51.0
- Apache ActiveMQ Artemis from 2.11.0 through 2.44.0.
Users are recommended to upgrade to Apache Artemis version 2.52.0, which fixes the issue.
The issue can be mitigated by one of the following:
- Remove Core protocol support from any acceptor receiving connections from untrusted sources. Incoming Core protocol connections are supported by default via the "artemis" acceptor listening on port 61616. See the "protocols" URL parameter configured for the acceptor. An acceptor URL without this parameter supports all protocols by default, including Core.
- Use two-way SSL (i.e. certificate-based authentication) in order to force every client to present the proper SSL certificate when establishing a connection before any message protocol handshake is attempted. This will prevent unauthenticated exploitation of this vulnerability.
- Implement and deploy a Core interceptor to deny all Core downstream federation connect packets. Such packets have a type of (int) -16 or (byte) 0xfffffff0. Documentation for interceptors is available at https://artemis.apache.org/components/artemis/documentation/latest/intercepting-operations.html .
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.apache.artemis:artemis-serverto a version that resolves this vulnerability.Fixed in 2.52.0 - Upgrade
Upgrade
org.apache.activemq:artemis-serverto a version that resolves this vulnerability.Fixed in 2.52.0 - Upgrade
Upgrade
org.apache.artemis:artemis-serverto a version that resolves this vulnerability.Fixed in 2.52.0 - Configuration
Configure the broker to use two-way SSL (certificate-based authentication) so clients must present the proper SSL certificate before any message protocol handshake is attempted.
Apache Artemis / Apache ActiveMQ Artemis use two-way SSL (certificate-based authentication) = enabled - Compensating control
For any acceptor that receives Core protocol connections from untrusted sources, remove Core protocol support from that acceptor (i.e., ensure the acceptor is not configured to accept Core; the acceptor’s 'protocols' URL parameter controls supported protocols).
- Compensating control
Implement and deploy a Core interceptor to deny all Core downstream federation connect packets.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27446?
CVE-2026-27446 is classified as a high-severity vulnerability due to its potential for unauthenticated access to critical functions.
How do I fix CVE-2026-27446?
To fix CVE-2026-27446, upgrade Apache Artemis or Apache ActiveMQ Artemis to a version that includes the security patch.
What versions are affected by CVE-2026-27446?
CVE-2026-27446 affects Apache Artemis versions 2.50.0 to 2.51.0 and Apache ActiveMQ Artemis versions 2.11.0 to 2.44.0.
Can CVE-2026-27446 be exploited remotely?
Yes, CVE-2026-27446 can be exploited by an unauthenticated remote attacker through the Core protocol.
What is the impact of CVE-2026-27446?
The impact of CVE-2026-27446 includes unauthorized access allowing attackers to manipulate broker connections.