CVE-2026-49364: Apache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-Authentication Cluster Credential Exposure to Discovered Peers
An unauthenticated network-adjacent attacker can leverage discovery to capture cluster administrative credentials during the initial cluster connection handshake.
This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0.
Users are recommended to upgrade to version 2.57.0, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Artemisto a version that resolves this vulnerability.Fixed in 2.57.0 - Upgrade
Upgrade
Apache ActiveMQ Artemisto a version that resolves this vulnerability.Fixed in 2.57.0 - Operational
After upgrading Apache Artemis / Apache ActiveMQ Artemis to 2.57.0, rotate any cluster administrative credentials that may have been exposed during initial cluster connection handshakes.
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments running Apache Artemis 2.50.0 through 2.56.0 or Apache ActiveMQ Artemis 1.0.0 through 2.44.0 are affected. Exposure requires cluster discovery to be reachable by a network-adjacent unauthenticated attacker.
What does an attacker need to exploit this issue?
An attacker must be network-adjacent and able to leverage the broker's discovery mechanism. No authentication is required before the initial cluster connection handshake in the affected versions.
What information can be exposed?
The attacker can capture cluster administrative credentials during the initial cluster connection handshake.
What is the available remediation?
Upgrade to Apache Artemis version 2.57.0, which fixes the issue.