CVE-2026-49364

Apache ActiveMQ Artemis brokers do not enforce authentication for the initial cluster connection handshake (CWE-306, Missing Authentication for Critical Function), so cluster administrative credentials are exchanged without authentication during discovery-driven cluster connections. An unauthenticated, network-adjacent attacker positioned on the same network segment as the brokers can capture these cluster administrative credentials during the handshake. With those credentials, the attacker can gain administrative access to the messaging cluster, compromising broker administration and message flows. Only deployments running affected versions in a clustered configuration that relies on discovery are exposed; this requires the attacker to already have access to the broker network, so internet exposure alone is not the primary risk. No exploitation has been reported, no public proof-of-concept exists, the issue is not in CISA's KEV, and CVSS scoring is pending; version 2.57.0 fixes the flaw.

What to do: Upgrade all cluster nodes to version 2.57.0, which fixes the issue. Until patched, restrict broker cluster/discovery network traffic to a trusted, isolated network segment (e.g., a dedicated VLAN) and rotate cluster administrative credentials if unauthenticated peers may have joined discovery. Also review broker logs for unexpected discovery or handshake connections from unknown hosts.