CVE-2026-49362: Apache Artemis, Apache ActiveMQ Artemis: Missing Authentication in CORE Protocol Handler Allows Unauthorized Queue Creation
An unauthenticated remote attacker can create arbitrary durable queues via the CORE protocol, leading to unauthorized broker state manipulation and potential denial of service.
This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0.
Users are recommended to upgrade to version 2.57.0, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Artemis, Apache ActiveMQ Artemisto a version that resolves this vulnerability.Fixed in 2.57.0Patch CVE-2026-49362
Event History
Frequently Asked Questions
Which deployments are exposed?
Apache Artemis versions 2.50.0 through 2.56.0 and Apache ActiveMQ Artemis versions 1.0.0 through 2.44.0 are affected. An attacker must be able to reach the broker remotely via the CORE protocol.
What access does an attacker need?
No authentication is required. An unauthenticated remote attacker can create arbitrary durable queues through the CORE protocol.
What is the practical impact?
Unauthorized durable queue creation allows manipulation of broker state and can lead to denial of service.
What version resolves the issue?
Upgrade to version 2.57.0, which fixes the issue.