CVE-2026-27446: CWE-306 Missing Authentication for Critical Function in Apache Software Foundation Apache Artemis
Missing Authentication for Critical Function (CWE-306) vulnerability in Apache Artemis, Apache ActiveMQ Artemis. An unauthenticated remote attacker can use the Core protocol to force a target broker to establish an outbound Core federation connection to an attacker-controlled rogue broker. This could potentially result in message injection into any queue and/or message exfiltration from any queue via the rogue broker. This impacts environments that allow both: - incoming Core protocol connections from untrusted sources to the broker - outgoing Core protocol connections from the broker to untrusted targets This issue affects: - Apache Artemis from 2.50.0 through 2.51.0 - Apache ActiveMQ Artemis from 2.11.0 through 2.44.0. Users are recommended to upgrade to Apache Artemis version 2.52.0, which fixes the issue. The issue can be mitigated by one of the following: - Remove Core protocol support from any acceptor receiving connections from untrusted sources. Incoming Core protocol connections are supported by default via the "artemis" acceptor listening on port 61616. See the "protocols" URL parameter configured for the acceptor. An acceptor URL without this parameter supports all protocols by default, including Core. - Use two-way SSL (i.e. certificate-based authentication) in order to force every client to present the proper SSL certificate when establishing a connection before any message protocol handshake is attempted. This will prevent unauthenticated exploitation of this vulnerability. - Implement and deploy a Core interceptor to deny all Core downstream federation connect packets. Such packets have a type of (int) -16 or (byte) 0xfffffff0. Documentation for interceptors is available at https://artemis.apache.org/components/artemis/documentation/latest/intercepting-operations.html .
AI Analysis
Technical Summary
This vulnerability (CVE-2026-27446) in Apache Artemis and Apache ActiveMQ Artemis is due to missing authentication on a critical function related to the Core protocol. An unauthenticated attacker can exploit this flaw to coerce a broker into establishing an outbound Core federation connection to an attacker-controlled rogue broker. This allows the attacker to inject messages into any queue or exfiltrate messages from any queue through the rogue broker. The vulnerability affects Apache Artemis versions from 2.50.0 up to and including 2.51.0, and Apache ActiveMQ Artemis versions from 2.11.0 up to and including 2.44.0. The flaw requires that the broker accepts inbound Core protocol connections from untrusted sources and has outbound connectivity to attacker-controlled systems. The vulnerability does not allow remote code execution or system compromise but impacts message confidentiality and integrity. Mitigations include restricting Core protocol support on acceptors from untrusted sources or enabling two-way SSL with certificate authentication. The issue is fixed in Apache Artemis 2.52.0.
Potential Impact
The vulnerability allows an unauthenticated remote attacker to force a broker to connect to a rogue broker controlled by the attacker, enabling message injection into any queue and/or message exfiltration from any queue. This compromises message confidentiality and integrity but does not allow remote code execution or cause service disruption. Exploitation requires the broker to accept inbound Core protocol connections from untrusted networks and have outbound connectivity to attacker-controlled systems.
Mitigation Recommendations
A fix is available in Apache Artemis version 2.52.0; users are strongly recommended to upgrade to this version. Alternatively, mitigate the issue by removing Core protocol support from acceptors that receive connections from untrusted sources by modifying the acceptor URL to exclude the Core protocol using the "protocols" URL parameter. Another mitigation is to configure two-way SSL with certificate-based authentication to prevent unauthenticated exploitation. A service restart or reload may be required for mitigation changes to take effect.
CVE-2026-27446: CWE-306 Missing Authentication for Critical Function in Apache Software Foundation Apache Artemis
Description
Missing Authentication for Critical Function (CWE-306) vulnerability in Apache Artemis, Apache ActiveMQ Artemis. An unauthenticated remote attacker can use the Core protocol to force a target broker to establish an outbound Core federation connection to an attacker-controlled rogue broker. This could potentially result in message injection into any queue and/or message exfiltration from any queue via the rogue broker. This impacts environments that allow both: - incoming Core protocol connections from untrusted sources to the broker - outgoing Core protocol connections from the broker to untrusted targets This issue affects: - Apache Artemis from 2.50.0 through 2.51.0 - Apache ActiveMQ Artemis from 2.11.0 through 2.44.0. Users are recommended to upgrade to Apache Artemis version 2.52.0, which fixes the issue. The issue can be mitigated by one of the following: - Remove Core protocol support from any acceptor receiving connections from untrusted sources. Incoming Core protocol connections are supported by default via the "artemis" acceptor listening on port 61616. See the "protocols" URL parameter configured for the acceptor. An acceptor URL without this parameter supports all protocols by default, including Core. - Use two-way SSL (i.e. certificate-based authentication) in order to force every client to present the proper SSL certificate when establishing a connection before any message protocol handshake is attempted. This will prevent unauthenticated exploitation of this vulnerability. - Implement and deploy a Core interceptor to deny all Core downstream federation connect packets. Such packets have a type of (int) -16 or (byte) 0xfffffff0. Documentation for interceptors is available at https://artemis.apache.org/components/artemis/documentation/latest/intercepting-operations.html .
CVSS v4.0
Score 9.3critical
Affected software
Apache Software Foundation
Apache Artemis
Apache Software Foundation
Apache ActiveMQ Artemis
pkg:maven/org.apache.activemq/artemis-core-clientpkg:maven/Apache Software Foundation/org.apache.artemis:artemis-serverpkg:maven/Apache Software Foundation/org.apache.activemq:artemis-serverRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability (CVE-2026-27446) in Apache Artemis and Apache ActiveMQ Artemis is due to missing authentication on a critical function related to the Core protocol. An unauthenticated attacker can exploit this flaw to coerce a broker into establishing an outbound Core federation connection to an attacker-controlled rogue broker. This allows the attacker to inject messages into any queue or exfiltrate messages from any queue through the rogue broker. The vulnerability affects Apache Artemis versions from 2.50.0 up to and including 2.51.0, and Apache ActiveMQ Artemis versions from 2.11.0 up to and including 2.44.0. The flaw requires that the broker accepts inbound Core protocol connections from untrusted sources and has outbound connectivity to attacker-controlled systems. The vulnerability does not allow remote code execution or system compromise but impacts message confidentiality and integrity. Mitigations include restricting Core protocol support on acceptors from untrusted sources or enabling two-way SSL with certificate authentication. The issue is fixed in Apache Artemis 2.52.0.
Potential Impact
The vulnerability allows an unauthenticated remote attacker to force a broker to connect to a rogue broker controlled by the attacker, enabling message injection into any queue and/or message exfiltration from any queue. This compromises message confidentiality and integrity but does not allow remote code execution or cause service disruption. Exploitation requires the broker to accept inbound Core protocol connections from untrusted networks and have outbound connectivity to attacker-controlled systems.
Mitigation Recommendations
A fix is available in Apache Artemis version 2.52.0; users are strongly recommended to upgrade to this version. Alternatively, mitigate the issue by removing Core protocol support from acceptors that receive connections from untrusted sources by modifying the acceptor URL to exclude the Core protocol using the "protocols" URL parameter. Another mitigation is to configure two-way SSL with certificate-based authentication to prevent unauthenticated exploitation. A service restart or reload may be required for mitigation changes to take effect.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- apache
- Date Reserved
- 2026-02-19T16:10:53.921Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-27446","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:18054","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:18055","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:3955","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:3957","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:18059","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:17668","vendor":"Red Hat"}]
Threat ID: 69a7f558d1a09e29cb1e3730
Added to database: 03/04/2026, 09:03:20 UTC
Last enriched: 08/12/2026, 13:01:56 UTC
Last updated: 09/14/2026, 12:32:36 UTC
Views: 1318
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.