CVE-2026-57967: Apache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session reattachment
An unauthenticated remote attacker can craft a CORE protocol SESSIONREATTACH packet to steal an existing session and assume ongoing execution of the previously authenticated session.
This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0.
Users are recommended to upgrade to version 2.57.0, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Artemisto a version that resolves this vulnerability.Fixed in 2.57.0Patch CVE-2026-57967 - Upgrade
Upgrade
Apache ActiveMQ Artemisto a version that resolves this vulnerability.Fixed in 2.57.0Patch CVE-2026-57967
Event History
Frequently Asked Questions
Which deployments are affected?
Apache Artemis versions 2.50.0 through 2.56.0 and Apache ActiveMQ Artemis versions 1.0.0 through 2.44.0 are affected.
What does an attacker need to exploit this issue?
An unauthenticated remote attacker needs to craft and send a CORE protocol SESSION_REATTACH packet targeting an existing session. Successful exploitation allows the attacker to steal that session and continue operating with the previously authenticated session's access.
What is the recommended remediation?
Upgrade to Apache Artemis version 2.57.0, which fixes the issue.