CVE-2026-40914

Overview

Apache ActiveMQ Artemis is an open-source, high-performance message broker and the next-generation broker of the Apache ActiveMQ project. It provides asynchronous messaging with a non-blocking, journal-backed core and supports multiple wire protocols and APIs, including AMQP 1.0, MQTT, STOMP, OpenWire, and Jakarta Messaging (JMS). Broker and client components are published as Maven artifacts under org.apache.activemq through 2.44.0, and under org.apache.artemis from 2.50.0.

An authorization bypass vulnerability (CVE-2026-40914) has been identified in the STOMP protocol handler of Apache ActiveMQ Artemis, which allows attackers who hold only the send or consume permission on an address to add a new routing type to that address without the createAddress permission. The attacker can then send messages to an address, or consume messages from a queue, using a routing type the address did not support, when the broker should have rejected the operation.

Per OWASP: Access control enforces policy such that users cannot act outside of their intended permissions. Failures typically lead to unauthorized information disclosure, modification, or destruction of all data or performing a business function outside the user's limits.

This issue affects multiple versions of Apache ActiveMQ Artemis.

Details

Module Info

• Product: Apache ActiveMQ Artemis
• Affected packages: org.apache.activemq:artemis-stomp-protocol, org.apache.artemis:artemis-stomp-protocol
• Affected versions:
  • org.apache.activemq:artemis-stomp-protocol: >=2.0.0 <=2.44.0
  • org.apache.artemis:artemis-stomp-protocol: >=2.50.0 <=2.53.0
• GitHub repository: https://github.com/apache/artemis
• Published packages:
  • https://central.sonatype.com/artifact/org.apache.activemq/artemis-stomp-protocol
  • https://central.sonatype.com/artifact/org.apache.artemis/artemis-stomp-protocol
• Package manager: Maven
• Fixed in:
  • OSS Apache ActiveMQ Artemis 2.54.0
  • NES for Apache ActiveMQ Artemis v2.19.5

Vulnerability Info

This Medium-severity vulnerability is found in the org.apache.activemq:artemis-stomp-protocol and org.apache.artemis:artemis-stomp-protocol packages in multiple versions of Apache ActiveMQ Artemis. When a STOMP client sends a SEND frame or a SUBSCRIBE frame, the broker calls StompConnection.autoCreateDestinationIfPossible with the destination and the routing type requested by the client, for example through the destination-type header of a SEND frame or the subscription-type header of a SUBSCRIBE frame. If the address does not exist, the method creates it through the session's createAddress, which checks that the user holds the createAddress permission. If the address already exists but does not support the requested routing type, the method takes a different branch:

} else if (!addressInfo.getRoutingTypes().contains(effectiveAddressRoutingType)) {
   if (addressSettings.isAutoCreateAddresses()) {
      EnumSet<RoutingType> routingTypes = EnumSet.noneOf(RoutingType.class);
      for (RoutingType existingRoutingType : addressInfo.getRoutingTypes()) {
         routingTypes.add(existingRoutingType);
      }
      routingTypes.add(effectiveAddressRoutingType);
      manager.getServer().updateAddressInfo(simpleDestination, routingTypes);
   }
}

This branch calls ActiveMQServer.updateAddressInfo directly instead of going through the user's session, so no security check runs for the update. When address auto-creation is enabled for the address, which is the default, any authenticated STOMP user who can send to or consume from the address can add ANYCAST or MULTICAST to its routing types. The later checkRoutingSemantics call then finds the requested routing type on the address and lets the frame through. The user's message is routed, or their subscription created, with semantics that the address's configuration and the createAddress permission were meant to forbid.

Mitigation

Only recent versions of Apache ActiveMQ Artemis are community-supported. Older lines are End-of-Life and will not receive public updates to address this issue.

Where upgrading is not immediately possible, disable address auto-creation for addresses that STOMP clients can reach, since the affected branch only runs when address auto-creation is enabled.

Users of the affected components should apply one of the following mitigations:

• Upgrade Apache ActiveMQ Artemis to a currently supported release that contains the fix (2.54.0 or later), which upstream publishes under the org.apache.artemis groupId; no fixed release exists under org.apache.activemq.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• Isaac David from bugbunny.ai (finder)
• Arthur Gervais from bugbunny.ai (finder)