CVE-2026-49362: Apache Artemis, Apache ActiveMQ Artemis: Missing Authentication in CORE Protocol Handler Allows Unauthorized Queue Creation
An unauthenticated remote attacker can create arbitrary durable queues via the CORE protocol, leading to unauthorized broker state manipulation and potential denial of service.
This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0.
Users are recommended to upgrade to version 2.57.0, which fixes the issue.
Other sources
submitted through leadership channels
Missing Authentication — Artemis CORE CREATEQUEUE(34) on ch1 creates durable queue pre-auth (JBoss EAP)
Missing authentication on the Artemis CORE protocol channel: an unauthenticated attacker can send CREATEQUEUE packets on channel 1 via the :8080 HTTP-upgrade path to create arbitrary durable JMS queues on the embedded broker, enabling resource exhaustion and persistent broker-state manipulation without any credentials.
findings/jboss-eap17.md
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Artemis / Apache ActiveMQ Artemisto a version that resolves this vulnerability.Fixed in 2.57.0
Event History
Frequently Asked Questions
Which deployments are exposed?
Apache Artemis versions 2.50.0 through 2.56.0 and Apache ActiveMQ Artemis versions 1.0.0 through 2.44.0 are affected. An attacker must be able to reach the broker remotely via the CORE protocol.
What access does an attacker need?
No authentication is required. An unauthenticated remote attacker can create arbitrary durable queues through the CORE protocol.
What is the practical impact?
Unauthorized durable queue creation allows manipulation of broker state and can lead to denial of service.
What version resolves the issue?
Upgrade to version 2.57.0, which fixes the issue.