EOL Fix Available | CVE-2026-27446

Overview

Apache ActiveMQ Artemis is an open-source, asynchronous messaging broker supporting the JMS, AMQP, MQTT, STOMP and Core protocols. It is widely deployed as the messaging backbone of Java applications, including as the embedded broker used by Spring Boot. Federation allows one broker to consume messages from another without clustering them; a downstream federation configuration is one in which a broker is asked to create a federation connection back to the requester.

An authorization bypass vulnerability (CVE-2026-27446) has been identified in Apache ActiveMQ Artemis, which allows attackers to make a broker establish an outbound federation connection to a broker they control without presenting any credentials. That connection can then be used to inject messages into any queue on the target broker and to exfiltrate messages from any queue.

Per OWASP: access control, sometimes called authorization, is how a web application grants access to content and functions to some users and not others; these checks are performed after authentication, and govern what authorized users are allowed to do. In this case no authentication was performed at all before the privileged function ran, so the check that should have governed it never happened.

This issue affects multiple versions of Apache ActiveMQ Artemis.

‍

Details

Module Info

Product: Apache ActiveMQ Artemis
Affected packages: org.apache.activemq:artemis-server
Affected versions: >=2.11.0 <=2.44.0
GitHub repository: https://github.com/apache/artemis
Published packages: https://central.sonatype.com/artifact/org.apache.activemq/artemis-server
Package manager: Maven
Fixed in: NES for ActiveMQ Artemis 2.19.1-artemis-server-2.19.3

Vulnerability Info

This Critical-severity vulnerability is found in the org.apache.activemq:artemis-server package in multiple versions of Apache ActiveMQ Artemis. The Core protocol handler processed the federation downstream connect packet in its general channel handler, alongside packets that legitimately precede authentication, and applied no authentication or permission check before acting on it:

} else if (packet.getType() == PacketImpl.FEDERATION_DOWNSTREAM_CONNECT) {
   final FederationDownstreamConnectMessage message = (FederationDownstreamConnectMessage) packet;
   final FederationDownstreamConfiguration downstreamConfiguration = message.getStreamConfiguration();

   final FederationConfiguration config = new FederationConfiguration();
   config.setName(message.getName() + FederationDownstreamConnectMessage.UPSTREAM_SUFFIX);
   config.setCredentials(message.getCredentials());

   // the upstream connector is built from the transport configuration carried in the packet

   try {
      server.getFederationManager().deploy(config);
   } catch (Exception e) {
      logger.error("Error deploying federation: " + e.getMessage(), e);
   }
}

Any peer able to complete a Core protocol handshake could therefore send the packet without credentials. On receiving it, the broker deploys an upstream federation connection back to the address the requester specifies, so the attacker controls one end of a federation link into the broker. Because federation moves messages in both directions, this yields message injection into any queue the broker hosts and exfiltration of messages from any queue.

The Core protocol is supported by default on the artemis acceptor on port 61616, so a broker reachable from an untrusted network is exposed in its default configuration. Exploitation additionally requires that the broker can open outbound Core protocol connections to a target the attacker controls.

This vulnerability was introduced in 2019 with Apache ActiveMQ Artemis 2.11.0.

‍

Mitigation

Only recent versions of Apache ActiveMQ Artemis are community-supported. The affected 2.19.x line is End-of-Life and will not receive public updates to address this issue.

Users of the affected components should apply one of the following mitigations:

Upgrade Apache ActiveMQ Artemis to a currently supported release that contains the fix (2.52.0 or later), which upstream publishes under the org.apache.artemis groupId; no fixed release exists under org.apache.activemq.
Leverage a commercial support partner like HeroDevs for post-EOL security support.

Where upgrading is not immediately possible, remove Core protocol support from any acceptor that accepts connections from untrusted sources, or require two-way SSL so that every client presents a certificate before the protocol handshake completes.

The fix is deny-by-default and requires configuration. It adds a downstream-authorization attribute on the federations element listing the roles permitted to deploy federation on the broker, and that list is empty by default, so a broker with security enabled refuses every incoming downstream federation request until roles are authorized. Deployments that use Core downstream federation must add the roles on the downstream broker before upgrading. After upgrading, the log messages AMQ224158 and AMQ224159 indicate that the attribute still needs configuring.

‍