CVE-2026-49362: Apache Artemis, Apache ActiveMQ Artemis: Missing Authentication in CORE Protocol Handler Allows Unauthorized Queue Creation
CVE-2026-49362: unauthenticated attackers can create arbitrary durable queues in ActiveMQ Artemis via the CORE protocol, enabling denial of service.
A missing authentication check in the CORE protocol handler of Apache Artemis and Apache ActiveMQ Artemis, tracked as CVE-2026-49362, lets unauthenticated remote attackers create arbitrary durable queues. This enables unauthorized broker state manipulation and potential denial of service. Affected versions are artemis-server in Apache Artemis 2.50.0 through 2.56.0 and ActiveMQ Artemis 1.0.0 through 2.44.0. Apache rates the issue as important.
- Missing authentication in CORE protocol handler
- Unauthenticated remote attackers can create arbitrary durable queues
- Leads to unauthorized broker state manipulation and potential DoS
- Rated important by the Apache Security Team
- CVEs
- CVE-2026-49362
- Vendors
- Apache
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-49362 | Unauthenticated Queue Creation in Apache ActiveMQ Artemis CORE Protocol | 7.5 | <1% |
From the original article
Posted by Clebert Suconic on Sep 09 Severity: important Affected versions: - Apache Artemis (org. apache. artemis:artemis-server) 2.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.