CVE-2026-27446 is a CWE-306 Missing Authentication for Critical Function vulnerability in Apache Artemis and Apache ActiveMQ Artemis. It allows an unauthenticated remote attacker to use the Core protocol to coerce a target broker into establishing an outbound federation connection to an attacker-controlled rogue broker. This can result in unauthorized message injection into or exfiltration from any queue. The vulnerability affects Apache Artemis versions 2.50.0 through 2.51.0 and Apache ActiveMQ Artemis versions 2.11.0 through 2.44.0. The vulnerability requires environments that permit both incoming Core protocol connections from untrusted sources and outgoing Core protocol connections to untrusted targets. The vendor fixed the issue in Apache Artemis 2.52.0. Mitigation options include disabling Core protocol support on acceptors exposed to untrusted sources, enforcing two-way SSL authentication to require client certificates, or deploying a Core interceptor to deny federation connect packets.

An unauthenticated attacker can exploit this vulnerability to force a broker to connect to a malicious broker, enabling message injection into queues or exfiltration of messages from queues. This compromises the confidentiality and integrity of messaging data handled by the affected brokers. The impact is high due to the ability to manipulate or steal messages without authentication.

A fix is available in Apache Artemis version 2.52.0; users are strongly recommended to upgrade to this version. Until upgrading, mitigation can be achieved by removing Core protocol support from acceptors exposed to untrusted sources, enforcing two-way SSL (certificate-based authentication) to require client certificates before protocol handshake, or deploying a Core interceptor to deny all Core downstream federation connect packets. These mitigations prevent unauthenticated exploitation of the vulnerability.