CVE-2026-57967: Apache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session reattachment

highVulnerabilityimportance 45CVE-2026-57967

AI summary · glm-5.3-flash

CVE-2026-57967: unauthenticated attackers can hijack authenticated ActiveMQ Artemis sessions via crafted CORE protocol SESSION_REATTACH packets.

An unauthenticated remote attacker can craft a CORE protocol SESSION_REATTACH packet to steal an existing session and assume ongoing execution of the previously authenticated session on Apache Artemis and ActiveMQ Artemis. Affected versions are artemis-server 2.50.0 through 2.56.0 in Apache Artemis and artemis-server 1.0.0 through 2.44.0 in Apache ActiveMQ Artemis. Apache rates the issue important.

Missing authentication on CORE session reattachment lets attackers steal live sessions.
Unauthenticated remote attackers can assume execution of an authenticated session.
Affects artemis-server 2.50.0-2.56.0 (Artemis) and 1.0.0-2.44.0 (ActiveMQ Artemis).

Read the original

VendorsApache

ProductsApache Artemis Apache ActiveMQ

Tagsapache activemq artemis message-broker session-hijack core-protocol

Vulnerabilities mentionedAll →

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2026-57967	Unauthenticated Session Hijack in Apache ActiveMQ Artemis CORE Protocol CVE-2026-57967 is a missing-authentication flaw (CWE-306) in the CORE protocol of Apache Artemis and Apache ActiveMQ Artemis message brokers. An unauthenticated remote attacker who can reach the broker's CORE acceptor can send a crafted SESSION_REATTACH packet to steal an already-established session. By doing so, the attacker assumes ongoing execution of the previously authenticated session, effectively impersonating a legitimate connected client. All versions from 1.0.0 through 2.44.0 (Apache ActiveMQ Artemis) and 2.50.0 through 2.56.0 (Apache Artemis) are affected, and version 2.57.0 fixes the issue. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known at this time. Do: Upgrade to Apache ActiveMQ Artemis 2.57.0, which fixes the issue for both product lines. Until upgraded, restrict network access to the broker's CORE acceptor port (commonly 61616) so only trusted networks and clients can reach it, and review broker logs for unexpected or unexplained session reattachment activity.	9.8	<1%		Apache Artemis 2.50.0 through 2.56.0 (fixed in 2.57.0) Apache ActiveMQ Artemis 1.0.0 through 2.44.0 (fixed in 2.57.0)	largetens of thousands of broker deployments worldwide, of which likely only thousands are internet-exposed (order-of-magnitude estimate)	6d ago

CVE

Vulnerability

CVSS

EPSS

Flags

Affected

Exposure

Published

CVE-2026-57967

Unauthenticated Session Hijack in Apache ActiveMQ Artemis CORE Protocol

CVE-2026-57967 is a missing-authentication flaw (CWE-306) in the CORE protocol of Apache Artemis and Apache ActiveMQ Artemis message brokers. An unauthenticated remote attacker who can reach the broker's CORE acceptor can send a crafted SESSION_REATTACH packet to steal an already-established session. By doing so, the attacker assumes ongoing execution of the previously authenticated session, effectively impersonating a legitimate connected client. All versions from 1.0.0 through 2.44.0 (Apache ActiveMQ Artemis) and 2.50.0 through 2.56.0 (Apache Artemis) are affected, and version 2.57.0 fixes the issue. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known at this time.

Do: Upgrade to Apache ActiveMQ Artemis 2.57.0, which fixes the issue for both product lines. Until upgraded, restrict network access to the broker's CORE acceptor port (commonly 61616) so only trusted networks and clients can reach it, and review broker logs for unexpected or unexplained session reattachment activity.

9.8

<1%

Apache Artemis 2.50.0 through 2.56.0 (fixed in 2.57.0)
Apache ActiveMQ Artemis 1.0.0 through 2.44.0 (fixed in 2.57.0)

largetens of thousands of broker deployments worldwide, of which likely only thousands are internet-exposed (order-of-magnitude estimate)

6d ago

Full article

Posted by Clebert Suconic on Sep 09 Severity: important Affected versions: - Apache Artemis (org.apache.artemis:artemis-server) 2.50.0 through 2.56.0 - Apache ActiveMQ Artemis (org.apache.activemq:artemis-server) 1.0.0 through 2.44.0 Description: An unauthenticated remote attacker can craft a CORE protocol SESSION_REATTACH packet to steal an existing session and assume ongoing execution of the previously authenticated session. This issue affects Apache Artemis: from 2.50.0...

This source does not provide full text. Read it at seclists.org.