Critical [CVE-2026-27446] Apache Artemis, Apache ActiveMQ Artemis: Auth bypass for Core downstream federation
This critical-severity Apache Software Foundation advisory covers CVE-2026-27446 affecting Apache Artemis, Apache ActiveMQ Artemis.
Android app · Google Play
Monitor future Apache Software Foundation CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
Missing Authentication for Critical Function (CWE-306) vulnerability in Apache Artemis, Apache ActiveMQ Artemis. An unauthenticated remote attacker can use the Core protocol to force a target broker to establish an outbound Core federation connection to an attacker-controlled rogue broker.
This could potentially result in message injection into any queue and/or message exfiltration from any queue via the rogue broker. This impacts environments that allow both:
- incoming Core protocol connections from untrusted sources to the broker
This issue affects:
Users are recommended to upgrade to Apache Artemis version 2.52.0, which fixes the issue.
The issue can be mitigated by one of the following:
- Use two-way SSL (i.e. certificate-based authentication) in order to force every client to present the proper SSL certificate when establishing a connection before any message protocol handshake is attempted. This will prevent unauthenticated exploitation of this vulnerability.
- Implement and deploy a Core interceptor to deny all Core downstream federation connect packets. Such packets have a type of (int) -16 or (byte) 0xfffffff0. Documentation for interceptors is available
- Apache Artemis 2.50.0 through 2.51.0
- Apache ActiveMQ Artemis 2.11.0 through 2.44.0
Official advisory · high-confidence parse· fetched 2 months ago·verify at source
- 2.52.0
Official advisory · high-confidence parse· fetched 2 months ago·verify at source
Mitigation checklist
- Users are recommended to upgrade to Apache Artemis version 2.52.0, which fixes the issue.
- The issue can be mitigated by one of the following: - Remove Core protocol support from any acceptor receiving connections from untrusted sources.
- This will prevent unauthenticated exploitation of this vulnerability. - Implement and deploy a Core interceptor to deny all Core downstream federation connect packets.
Official advisory · high-confidence parse· fetched 2 months ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.