CVE-2026-50632: Apache CXF JMSConfigFactory JNDI Injection Vulnerability
Summary
CVE-2026-50632: Apache CXF has JNDI Injection Vulnerability in JMSConfigFactory. Affects org.apache.cxf:cxf-rt-transports-jms across 2 version ranges.
< 4.1.7
>= 4.2.0, < 4.2.2
Fixed in 4.1.7 or 4.2.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache CXF is an open-source services framework that helps in building and developing web services. It provides a robust architecture for creating SOAP and RESTful services, allowing developers to integrate various protocols and data formats. The framework is widely used for its flexibility and ease of use. However, it has been found to have a JNDI injection vulnerability in the JMSConfigFactory, which can be exploited if untrusted users are allowed to configure JMS settings.
Vulnerability Detail
The vulnerability arises from an incomplete fix for a previous advisory (CVE-2026-44417) that allowed untrusted JMS configurations to lead to remote code execution (RCE). This means that if an attacker can manipulate the JMS configuration, they could potentially execute arbitrary code on the server, leading to severe security risks. The vulnerability affects versions of the package prior to 4.2.2 and 4.1.7, making it critical for users to upgrade to these patched versions to mitigate the risk.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.1.74.1.7 -
>= 4.2.0, < 4.2.24.2.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, restrict the ability of untrusted users to configure JMS settings in Apache CXF. This can help mitigate the risk until the package is updated to a secure version.
Conclusion
In summary, CVE-2026-50632 is a critical vulnerability in Apache CXF that can lead to remote code execution if untrusted users can configure JMS settings. It is essential to upgrade to the patched versions (4.2.2 or 4.1.7) to mitigate this risk. Users should also consider using Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for org.apache.cxf:cxf-rt-transports-jms →
FAQ
CVE-2026-50632 is a critical vulnerability in Apache CXF's JMSConfigFactory that allows for JNDI injection, potentially leading to remote code execution.
Versions prior to 4.2.2 and 4.1.7 of the org.apache.cxf:cxf-rt-transports-jms package are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software by analyzing the pom.xml file. Visit Vulert Scanner to check your application without needing to sign up.
If immediate upgrading is not possible, restrict untrusted user access to JMS configuration settings as a temporary workaround.
The CVSS score for CVE-2026-50632 is 9.8, indicating a critical level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.cxf:cxf-rt-transports-jms.
