CVE-2025-27391

Overview

Apache ActiveMQ Artemis is an open-source, high-performance message broker and the next-generation broker of the Apache ActiveMQ project. It provides asynchronous messaging with a non-blocking, journal-backed core and supports multiple wire protocols and APIs, including AMQP 1.0, MQTT, STOMP, OpenWire, and Jakarta Messaging (JMS). Broker and client components are published as Maven artifacts under org.apache.activemq.

An information exposure vulnerability (CVE-2025-27391) has been identified in the broker configuration code of Apache ActiveMQ Artemis, which allows attackers with access to the broker's logs to read passwords and other secret broker property values. Every broker property key and value is written to the log in plain text when the org.apache.activemq.artemis.core.config.impl.ConfigurationImpl logger has the debug level enabled.

Per OWASP: Access control enforces policy such that users cannot act outside of their intended permissions. Failures typically lead to unauthorized information disclosure, modification, or destruction of all data or performing a business function outside the user's limits.

This issue affects Apache ActiveMQ Artemis versions 1.5.1 and greater, before 2.40.0.

‍

Details

Module Info

• Product: Apache ActiveMQ Artemis
• Affected packages: org.apache.activemq:artemis-server
• Affected versions: >=1.5.1 <2.40.0
• GitHub repository: https://github.com/apache/activemq-artemis
• Published packages: https://central.sonatype.com/artifact/org.apache.activemq/artemis-server
• Package manager: Maven
• Fixed in:
  • OSS Apache ActiveMQ Artemis 2.40.0
  • NES for Apache ActiveMQ Artemis v2.19.6

Vulnerability Info

This Medium-severity vulnerability is found in the org.apache.activemq:artemis-server package in versions 1.5.1 and greater, before 2.40.0, of Apache ActiveMQ Artemis. Broker properties let an operator override any broker configuration value, including passwords such as cluster, bridge or connector credentials, without editing broker.xml. In the 2.19 version line they are supplied as JVM system properties carrying the brokerconfig. prefix, and the broker reads them every time it starts, when ActiveMQServerImpl calls ConfigurationImpl.parseSystemProperties():

public Configuration parseSystemProperties(Properties properties) throws Exception {
   Map<String, Object> beanProperties = new HashMap<>();

   synchronized (properties) {
      for (Map.Entry<Object, Object> entry : properties.entrySet()) {
         if (entry.getKey().toString().startsWith(systemPropertyPrefix)) {
            String key = entry.getKey().toString().substring(systemPropertyPrefix.length());
            logger.debug("Setting up config, " + key + "=" + entry.getValue());
            beanProperties.put(key, entry.getValue());
         }
      }
   }
   ...
}

The debug statement writes the raw value of each property next to its key, with no check of the key name and no handling of ENC()-masked values. When the ConfigurationImpl logger is set to DEBUG, a value such as brokerconfig.clusterPassword=secret is copied into the broker log as plain text. Anyone who can read the log files, a log aggregation system, or a support bundle that includes them can then recover the password and use it to authenticate to the broker or to the systems it connects to.

‍

Mitigation

Only recent versions of Apache ActiveMQ Artemis are community-supported. Older lines are End-of-Life and will not receive public updates to address this issue.

The Apache ActiveMQ project notes that the issue can be mitigated by restricting log access to only trusted users.

Users of the affected components should apply one of the following mitigations:

• Upgrade Apache ActiveMQ Artemis to a currently supported release that contains the fix.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

‍

Credits

• Rafael Yanez Illescas (finder)