CVE-2026-27446 is a Missing Authentication for Critical Function (CWE-306) vulnerability in Apache Artemis and Apache ActiveMQ Artemis. It allows an unauthenticated remote attacker to exploit the Core protocol to coerce a target broker into establishing an outbound Core federation connection to an attacker-controlled rogue broker. This can result in unauthorized message injection into or exfiltration from any queue. The vulnerability affects environments that permit both incoming Core protocol connections from untrusted sources and outgoing Core protocol connections to untrusted targets. Affected versions include Apache Artemis from 2.50.0 through 2.51.0 and Apache ActiveMQ Artemis from 2.11.0 through 2.44.0. The issue is fixed in Apache Artemis 2.52.0. Mitigation options include disabling Core protocol support on acceptors exposed to untrusted sources, implementing two-way SSL authentication to require client certificates before protocol handshake, or deploying a Core interceptor to deny downstream federation connect packets. Red Hat advisories confirm the vulnerability and provide updated packages addressing this issue.

An unauthenticated remote attacker can exploit this vulnerability to force a broker to connect to a malicious broker, potentially allowing message injection into any queue or exfiltration of messages from any queue. This compromises the confidentiality and integrity of messaging data handled by the affected brokers. The vulnerability requires that the environment allows both incoming Core protocol connections from untrusted sources and outgoing Core protocol connections to untrusted targets. The CVSS 4.0 base score is 9.3, indicating critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality and integrity.

A fix is available in Apache Artemis version 2.52.0; users are strongly recommended to upgrade to this version. Alternatively, mitigation can be achieved by removing Core protocol support from acceptors exposed to untrusted sources, such as disabling the default 'artemis' acceptor on port 61616 or configuring the 'protocols' URL parameter to exclude Core. Implementing two-way SSL (certificate-based authentication) will require clients to present valid certificates before any protocol handshake, preventing unauthenticated exploitation. Deploying a Core interceptor to deny all Core downstream federation connect packets (type (int) -16 or (byte) 0xfffffff0) is another mitigation approach. Users should consult the vendor advisories for detailed guidance and apply patches or mitigations accordingly.