Apache ActiveMQ Artemis

Related CVEsby mentions

• CVE-2026-493649.1<1%
  Pre-Auth Cluster Credential Exposure in Apache ActiveMQ Artemis Discovery
  Apache ActiveMQ Artemis brokers do not enforce authentication for the initial cluster connection handshake (CWE-306, Missing Authentication for Critical Function), so cluster administrative credentials are exchanged without authentication during discovery-driven cluster connections. An unauthenticated, network-adjacent attacker positioned on the same network segment as the brokers can capture these cluster administrative credentials during the handshake. With those credentials, the attacker can gain administrative access to the messaging cluster, compromising broker administration and message flows. Only deployments running affected versions in a clustered configuration that relies on discovery are exposed; this requires the attacker to already have access to the broker network, so internet exposure alone is not the primary risk. No exploitation has been reported, no public proof-of-concept exists, the issue is not in CISA's KEV, and CVSS scoring is pending; version 2.57.0 fixes the flaw.
  · Apache Artemis 2.50.0 through 2.56.0 · Apache ActiveMQ Artemis 1.0.0 through 2.44.0large
• CVE-2026-493627.5<1%
  Unauthenticated Queue Creation in Apache ActiveMQ Artemis CORE Protocol
  CVE-2026-49362 is a missing-authentication flaw (CWE-306) in the CORE protocol handler of Apache ActiveMQ Artemis and Apache Artemis: the broker accepts CORE protocol commands without requiring any credentials. A remote attacker with network access to the broker's CORE acceptor (the default messaging port) can create arbitrary durable queues without authenticating, manipulating broker state without authorization. Because durable queues persist and consume broker resources, an attacker can repeatedly create queues to exhaust storage or memory and cause a denial of service; the queue creation itself also corrupts the intended broker configuration. All Apache ActiveMQ Artemis versions 1.0.0 through 2.44.0 and Apache Artemis versions 2.50.0 through 2.56.0 are affected. There is no CVSS score yet, no public proof-of-concept, and no known exploitation in the wild; the fix is available in version 2.57.0.
  · Apache ActiveMQ Artemis 1.0.0 through 2.44.0 (inclusive) · Apache Artemis 2.50.0 through 2.56.0 (inclusive)large
• CVE-2026-493637.5<1%
  Pre-Auth Topology Information Disclosure in Apache ActiveMQ Artemis CORE Protocol
  CVE-2026-49363 is a missing-authentication flaw (CWE-306) in the CORE protocol of Apache ActiveMQ Artemis/Apache Artemis that allows an unauthenticated remote client to learn cluster topology details. An attacker connects to the broker's CORE acceptor and sends a SUBSCRIBE_TOPOLOGY request before authenticating, receiving cluster node information in response. The disclosure is limited to cluster node details, but it gives outsiders reconnaissance material about the messaging infrastructure that could support targeted follow-on attacks. Any deployment running Apache Artemis 2.50.0-2.56.0 or Apache ActiveMQ Artemis 1.0.0-2.44.0 that accepts untrusted CORE connections is affected, which spans essentially the project's entire release history. There is no public proof-of-concept, no CISA KEV listing, no CVSS score yet, and no known exploitation reported.
  · Apache Artemis 2.50.0 through 2.56.0 · Apache ActiveMQ Artemis 1.0.0 through 2.44.0large
• CVE-2026-578226.5<1%
  Authenticated deserialization DoS in Apache ActiveMQ Artemis brokers
  When an Apache Artemis or Apache ActiveMQ Artemis broker processes message-based management requests, it deserializes certain method parameters—including ones the broker does not actually use—and the permitted types can be abused to craft a payload that forces excessive computation, pinning the processing thread and causing a denial of service. Triggering the flaw requires an authenticated messaging client that is authorized with the MANAGE permission to perform management-via-messaging, so anonymous or unprivileged clients cannot exploit it. An attacker with such access can repeatedly submit crafted management messages to tie up broker processing capacity, degrading or blocking message handling. Affected deployments run Apache ActiveMQ Artemis 1.3.0 through 2.44.0 or Apache Artemis 2.50.0 through 2.56.0; the fix ships in version 2.57.0. No public proof-of-concept or in-the-wild exploitation is known, and the issue has not yet been scored under CVSS.
  · Apache Artemis 2.50.0 through 2.56.0 · Apache ActiveMQ Artemis 1.3.0 through 2.44.0large

Appears with