Threat Intelligence Database

CVE-2026-27446 is a critical vulnerability in Apache Artemis and Apache ActiveMQ Artemis caused by missing authentication for a critical function. An unauthenticated remote attacker can exploit the Core protocol to force a target broker to establish an outbound federation connection to a rogue broker controlled by the attacker. This can lead to message injection into any queue or message exfiltration from any queue via the rogue broker. The vulnerability affects Apache Artemis versions from 2.50.0 through 2.51.0 and Apache ActiveMQ Artemis from 2.11.0 through 2.44.0. The issue is fixed in Apache Artemis version 2.52.0. Mitigations include removing Core protocol support from acceptors that receive connections from untrusted sources or configuring two-way SSL with certificate-based authentication.

AMQ Broker is a high-performance messaging implementation based on ActiveMQ Artemis. It uses an asynchronous journal for fast message persistence, and supports multiple languages, protocols, and platforms. This release of Red Hat AMQ Broker 7.12.5 includes security and bug fixes, and enhancements. For further information, refer to the release notes linked to in the References section. Security Fix(es): * (CVE-2025-48734) commons-beanutils: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default * (CVE-2025-49146) postgresql: pgjdbc insecure authentication in channel binding For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.