CVE-2026-57967: Apache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session reattachment
An unauthenticated remote attacker can craft a CORE protocol SESSIONREATTACH packet to steal an existing session and assume ongoing execution of the previously authenticated session.
This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0.
Users are recommended to upgrade to version 2.57.0, which fixes the issue.
Other sources
indepth analysis: https://docs.google.com/document/d/1XdX8AJzGjBgCLE0UZ5NRGGrzQ14HSVS8HcDgH0X70w/edit?tab=t.d440c4doqxdr#bookmark=kix.ffo7qhxjskp1
The finding correctly identifies a composite attack chain where an unauthenticated attacker exploits three independently verified weaknesses in the Artemis CORE protocol: (1) the SUBSCRIBETOPOLOGYV2 handler on channel0 leaks the broker's nodeID (a type-1 UUID) without authentication, revealing the MAC address and clock sequence embedded in the UUID; (2) cluster-bridge sessions are named using type-1 UUIDs generated by the same UUIDGenerator instance with the same MAC/clock-sequence seed, making session names predictable to within ~10,000 candidates (the number of 100ns intervals per millisecond); (3) the REATTACHSESSION handler (ActiveMQPacketHandler.handleReattachSession()) performs zero authentication — it looks up the session by name only and calls transferConnection() unconditionally, migrating the authenticated session to the attacker's connection. The hijacked cluster-bridge session inherits full broker-management authority (message injection, topology manipulation, journal access)
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Artemis / Apache ActiveMQ Artemisto a version that resolves this vulnerability.Fixed in 2.57.0
Event History
Frequently Asked Questions
Which deployments are affected?
Apache Artemis versions 2.50.0 through 2.56.0 and Apache ActiveMQ Artemis versions 1.0.0 through 2.44.0 are affected.
What does an attacker need to exploit this issue?
An unauthenticated remote attacker needs to craft and send a CORE protocol SESSION_REATTACH packet targeting an existing session. Successful exploitation allows the attacker to steal that session and continue operating with the previously authenticated session's access.
What is the recommended remediation?
Upgrade to Apache Artemis version 2.57.0, which fixes the issue.