CVE-2026-49364: Apache Artemis, Apache ActiveMQ Artemis: Pre-Authentication Cluster Credential Exposure to Discovered Peers
Apache Artemis CVE-2026-49364 exposes cluster credentials to network-adjacent peers discovered before authentication completes.
Apache disclosed a pre-authentication credential exposure issue in Apache Artemis and Apache ActiveMQ Artemis, tracked as CVE-2026-49364. Affected components span artemis-core-client and artemis-server from version 1.0.0 (ActiveMQ Artemis) and 2.50.0 (Artemis) through 2.44.0 and 2.56.0 respectively. An unauthenticated network-adjacent attacker can leverage credentials exposed to discovered cluster peers. Apache rates the issue as important.
- Cluster credentials are exposed to discovered peers pre-authentication
- Network-adjacent unauthenticated attacker can leverage exposed credentials
- Very broad affected range: ActiveMQ Artemis 1.0.0-2.44.0 and Artemis 2.50.0-2.56.0
- Rated important by the Apache Security Team
- CVEs
- CVE-2026-49364
- Vendors
- Apache
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-49364 | Pre-Auth Cluster Credential Exposure in Apache ActiveMQ Artemis Discovery | 9.1 | <1% |
From the original article
Posted by Clebert Suconic on Sep 09 Severity: important Affected versions: - Apache Artemis (org. apache. artemis:artemis-core-client) 2.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.