CVE-2026-27446: Apache Artemis and ActiveMQ Artemis Critical Authentication Bypass Vulnerability
Summary
CVE-2026-27446: Apache Artemis and Apache ActiveMQ Artemis are Missing Authentication for Critical Functions. Affects org.apache.activemq:artemis-server versions >= 2.11.0, <= 2.44.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Artemis and Apache ActiveMQ Artemis are open-source messaging systems that facilitate communication between different applications through message queues. They are designed for high performance and reliability, supporting various messaging protocols. However, they are vulnerable to a critical issue where an unauthenticated remote attacker can exploit the Core protocol to establish unauthorized connections, leading to potential message injection and exfiltration.
Vulnerability Detail
The vulnerability arises from missing authentication for critical functions (CWE-306) in Apache Artemis and Apache ActiveMQ Artemis. An attacker can leverage this flaw to force a broker to connect to a rogue broker, allowing them to inject or exfiltrate messages from any queue. This poses significant risks, especially in environments that permit incoming and outgoing Core protocol connections from untrusted sources.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users can mitigate the vulnerability by removing Core protocol support from any acceptor that receives connections from untrusted sources. This can be done by configuring the acceptor URL without the 'protocols' parameter, or by implementing two-way SSL to enforce certificate-based authentication for all clients.
Conclusion
The CVE-2026-27446 vulnerability in Apache Artemis and ActiveMQ Artemis poses a significant risk due to missing authentication for critical functions. Users are urged to upgrade to the latest versions and consider implementing additional security measures to protect their messaging systems.
See every vulnerability recorded for org.apache.activemq:artemis-server →
FAQ
CVE-2026-27446 is a critical vulnerability in Apache Artemis and ActiveMQ Artemis that allows unauthenticated remote attackers to exploit the Core protocol for unauthorized message injection and exfiltration.
The vulnerability affects Apache Artemis versions from 2.50.0 to 2.51.0 and Apache ActiveMQ Artemis versions from 2.11.0 to 2.44.0.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application's pom.xml for vulnerabilities without needing to install anything.
Upgrade to the patched versions of the affected packages and consider implementing two-way SSL for enhanced security.
The CVSS score of this vulnerability is 9.3, indicating a critical level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.activemq:artemis-server.
