CVE-2026-32642

Overview

Apache ActiveMQ Artemis is an open-source, high-performance message broker and the next-generation broker of the Apache ActiveMQ project. It provides asynchronous messaging with a non-blocking, journal-backed core and supports multiple wire protocols and APIs, including AMQP 1.0, MQTT, STOMP, OpenWire, and Jakarta Messaging (JMS). Broker and client components are published as Maven artifacts under org.apache.activemq through 2.44.0, and under org.apache.artemis from 2.50.0.

An authorization bypass vulnerability (CVE-2026-32642) has been identified in the OpenWire protocol support of Apache ActiveMQ Artemis, which allows an authenticated user without the createAddress permission to cause the broker to create an address. When address auto-creation is disabled, a non-durable JMS topic subscription on an address that does not exist results in a temporary address being created instead of the subscription being rejected.

Per OWASP: Access control enforces policy such that users cannot act outside of their intended permissions. Failures typically lead to unauthorized information disclosure, modification, or destruction of all data or performing a business function outside the user's limits.

This issue affects multiple versions of Apache ActiveMQ Artemis.

‍

Details

Module Info

• Product: Apache ActiveMQ Artemis
• Affected packages: org.apache.activemq:artemis-openwire-protocol, org.apache.artemis:artemis-openwire-protocol
• Affected versions:
  • org.apache.activemq:artemis-openwire-protocol: >=2.0.0 <=2.44.0
  • org.apache.artemis:artemis-openwire-protocol: >=2.50.0 <=2.52.0
• GitHub repository: https://github.com/apache/artemis
• Published packages: https://central.sonatype.com/artifact/org.apache.activemq/artemis-openwire-protocol, https://central.sonatype.com/artifact/org.apache.artemis/artemis-openwire-protocol
• Package manager: Maven
• Fixed in:
  • OSS Apache ActiveMQ Artemis 2.53.0
  • NES for Apache ActiveMQ Artemis v2.19.5

Vulnerability Info

This Medium-severity vulnerability is found in the org.apache.activemq:artemis-openwire-protocol and org.apache.artemis:artemis-openwire-protocol packages in multiple versions of Apache ActiveMQ Artemis. When an OpenWire client opens a consumer, AMQSession.createConsumer checks whether the destination exists, and whether it may be auto-created, only for queue destinations. Topic destinations skip that check entirely:

for (ActiveMQDestination openWireDest : dests) {
   ...
   if (openWireDest.isQueue()) {
      openWireDest = protocolManager.virtualTopicConsumerToFQQN(openWireDest);
      SimpleString queueName = SimpleString.of(convertWildcard(openWireDest));

      if (!checkAutoCreateQueue(queueName, openWireDest.isTemporary(), OpenWireUtil.extractFilterStringOrNull(info, openWireDest))) {
         throw new InvalidDestinationException("Destination doesn't exist: " + queueName);
      }
   }
   AMQConsumer consumer = new AMQConsumer(this, openWireDest, info, scheduledPool, isInternalAddress);
   ...
}

For a non-durable topic subscription, AMQConsumer then creates a non-durable, temporary subscription queue on the topic's address:

session.getCoreSession().createQueue(QueueConfiguration.of(queueName).setAddress(address).setRoutingType(RoutingType.MULTICAST).setFilterString(selector).setDurable(false).setTemporary(true).setInternal(internalAddress));

ServerSessionImpl.createQueue checks the queue-creation permission, but it only checks CREATE_ADDRESS when the address settings allow address auto-creation:

securityCheck(queueConfiguration.getAddress(), queueConfiguration.getName(), queueConfiguration.isDurable() ? CheckType.CREATE_DURABLE_QUEUE : CheckType.CREATE_NON_DURABLE_QUEUE, this);

AddressSettings as = server.getAddressSettingsRepository().getMatch(queueConfiguration.getAddress().toString());

AddressInfo addressInfo = server.getAddressInfo(queueConfiguration.getAddress());

if (as.isAutoCreateAddresses() && (addressInfo == null || !addressInfo.getRoutingTypes().contains(queueConfiguration.getRoutingType()))) {
   securityCheck(queueConfiguration.getAddress(), queueConfiguration.getName(), CheckType.CREATE_ADDRESS, this);
}

Because the queue is temporary, ActiveMQServerImpl.createQueue adds the missing address anyway:

if (queueConfiguration.isAutoCreateAddress() || queueConfiguration.isTemporary()) {
   if (info == null) {
      addAddressInfo(new AddressInfo(queueConfiguration.getAddress(), queueConfiguration.getRoutingType()).setAutoCreated(true).setTemporary(queueConfiguration.isTemporary()).setInternal(queueConfiguration.isInternal()));
   }
   ...
}

So with address auto-creation disabled, an authenticated user who holds the queue-creation permission but not createAddress can subscribe to a topic on an address that does not exist, and the broker creates a temporary address for it. The subscription should fail instead, because the user is not authorized to create that address. The address is removed again when the OpenWire connection closes.

‍

Mitigation

Only recent versions of Apache ActiveMQ Artemis are community-supported. Older lines are End-of-Life and will not receive public updates to address this issue.

Where upgrading is not immediately possible, grant the createNonDurableQueue permission only to users who are also allowed to create the corresponding addresses, since the subscription cannot create the address without that permission.

Users of the affected components should apply one of the following mitigations:

• Upgrade Apache ActiveMQ Artemis to a currently supported release that contains the fix (2.53.0 or later), which upstream publishes under the org.apache.artemis groupId; no fixed release exists under org.apache.activemq.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

‍

Credits

• Stephen Higgs (finder)