REDHAT-BUG-2480638: High severity Apache ActiveMQ Artemis vulnerability

Published May 21, 2026

Updated

indepth analysis: https://docs.google.com/document/d/1XdX8AJzGjBgCLE0UZ5NRGGrzQ14HSVS8HcDgH0X70w/edit?tab=t.d440c4doqxdr#bookmark=kix.ffo7qhxjskp1

The finding correctly identifies a composite attack chain where an unauthenticated attacker exploits three independently verified weaknesses in the Artemis CORE protocol: (1) the SUBSCRIBETOPOLOGYV2 handler on channel0 leaks the broker's nodeID (a type-1 UUID) without authentication, revealing the MAC address and clock sequence embedded in the UUID; (2) cluster-bridge sessions are named using type-1 UUIDs generated by the same UUIDGenerator instance with the same MAC/clock-sequence seed, making session names predictable to within ~10,000 candidates (the number of 100ns intervals per millisecond); (3) the REATTACHSESSION handler (ActiveMQPacketHandler.handleReattachSession()) performs zero authentication — it looks up the session by name only and calls transferConnection() unconditionally, migrating the authenticated session to the attacker's connection. The hijacked cluster-bridge session inherits full broker-management authority (message injection, topology manipulation, journal access)

Affected Software

1 affected component

Apache ActiveMQ Artemis

Event History

May 21, 2026

Data Sourced

via Red Hat·09:32 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The attack chain is described as unauthenticated. An attacker must be able to communicate with the Artemis CORE protocol endpoint in order to obtain topology information and attempt session reattachment.

Which deployments are most exposed?

Deployments using Artemis clustering with cluster-bridge sessions are directly relevant, because the predicted session name is used to hijack a cluster-bridge session. Exposure also depends on the attacker being able to reach the broker's CORE protocol service.

What is the impact of successfully hijacking a session?

A hijacked cluster-bridge session inherits full broker-management authority. The described consequences include message injection, topology manipulation, and journal access.

How does the attacker predict a target session name?

The topology subscription handler exposes the broker nodeID, which is a type-1 UUID containing the MAC address and clock sequence. Cluster-bridge session names are generated using type-1 UUIDs from the same generator seed, reducing the search to roughly 10,000 candidate values.

Is authentication enforced when reattaching the targeted session?

No. The described REATTACH_SESSION handling looks up a session by name and transfers its connection without authentication.

REDHAT-BUG-2480638: High severity Apache ActiveMQ Artemis vulnerability

Affected Software

Event History

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Which deployments are most exposed?

What is the impact of successfully hijacking a session?

How does the attacker predict a target session name?

Is authentication enforced when reattaching the targeted session?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Which deployments are most exposed?

What is the impact of successfully hijacking a session?

How does the attacker predict a target session name?

Is authentication enforced when reattaching the targeted session?