# CVE-2021-26118: Apache ActiveMQ Artemis improper access control in OpenWire protocol

Source: https://junglewise.ai/threats/cve-2021-26118-apache-activemq-artemis-improper-access-control-in-openwire  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2021-06-16. Updated: 2026-07-07  
License: CC BY 4.0 with a link back

CVE-2021-26118 · Severity: high · CVSS 7.5 · Published 2021-06-16

Apache ActiveMQ Artemis, a popular message broker used for communication between different software applications, contains a security flaw in how it handles certain internal notification messages. An attacker could exploit this to bypass security policies and send unauthorized messages, potentially disrupting operations or manipulating data flow. This issue affects systems using the OpenWire protocol and has been resolved in version 2.16.0.

Technologies: [Apache Activemq Artemis](https://junglewise.ai/threats/technologies/activemq-artemis). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache), [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2021-26118 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2021-26118 being exploited in the wild.

**How severe is CVE-2021-26118?** High severity, with a CVSS score of 7.5, published 16 June 2021.

**Which products and versions are affected?** Apache Activemq Artemis < 2.16.0; org.apache.activemq:artemis-openwire-protocol (Maven) < 2.16.0, ECOSYSTEM:introduced=0,fixed=2.16.0.

**Is there a fix for CVE-2021-26118?** Yes. org.apache.activemq:artemis-openwire-protocol (Maven): upgrade to 2.16.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2021-26118 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2021-26118?** Check whether you run Apache Activemq Artemis or org.apache.activemq:artemis-openwire-protocol (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.apache.activemq:artemis-openwire-protocol (Maven): upgrade to 2.16.0 or later

  ```sh
  # set org.apache.activemq:artemis-openwire-protocol to 2.16.0 in your pom.xml or build.gradle
  ```


## Technical details

A vulnerability in the OpenWire protocol head of Apache ActiveMQ Artemis (specifically identified in version 2.15.0) allows for the production of advisory messages without proper access control. The root cause is a failure to apply policy-based access control to these specific message types, which effectively allows an attacker to bypass security restrictions for the entire session. This is a network-reachable vulnerability that requires no authentication or user interaction. An attacker can exploit this to inject unauthorized advisory messages, impacting the integrity of the messaging system. The issue is addressed in version 2.16.0.

## Affected products

- Apache ActiveMQ Artemis < 2.16.0

## Identifiers

- CVE-2021-26118
- GHSA-q7fr-vqhq-v5xr

## Timeline

- 2021-01-27: disclosed: NVD published date
- 2021-06-16: advisory: GitHub Advisory published
- 2020-10-29: patched: Fix committed to repository

## References

- [https://lists.apache.org/thread.html/rafd5d7cf303772a0118865262946586921a65ebd98fc24f56c812574@%3Cannounce.apache.org%3E](https://lists.apache.org/thread.html/rafd5d7cf303772a0118865262946586921a65ebd98fc24f56c812574@%3Cannounce.apache.org%3E)
- [https://mail-archives.apache.org/mod_mbox/activemq-users/202101.mbox/%3CCAH%2BvQmMUNnkiXv2-d3ucdErWOsdnLi6CgnK%2BVfixyJvTgTuYig%40mail.gmail.com%3E](https://mail-archives.apache.org/mod_mbox/activemq-users/202101.mbox/%3CCAH%2BvQmMUNnkiXv2-d3ucdErWOsdnLi6CgnK%2BVfixyJvTgTuYig%40mail.gmail.com%3E)
- [https://github.com/apache/activemq-artemis/commit/e5566d52116d81611d914548adc3cbb14d7118d4](https://github.com/apache/activemq-artemis/commit/e5566d52116d81611d914548adc3cbb14d7118d4)
- [https://lists.apache.org/thread.html/rafd5d7cf303772a0118865262946586921a65ebd98fc24f56c812574%40%3Cannounce.apache.org%3E](https://lists.apache.org/thread.html/rafd5d7cf303772a0118865262946586921a65ebd98fc24f56c812574%40%3Cannounce.apache.org%3E)
- [https://security.netapp.com/advisory/ntap-20210827-0002](https://security.netapp.com/advisory/ntap-20210827-0002)

## Related threats

- [Apache ActiveMQ Artemis unsafe reflection in federation](https://junglewise.ai/threats/cve-2026-101292-apache-activemq-artemis-before-2-34-0-contains-an-unsafe)
- [Apache ActiveMQ Artemis denial of service via crafted wildcard selector](https://junglewise.ai/threats/cve-2026-75880-apache-activemq-artemis-denial-of-service-via-crafted-wildcard)
- [Apache Artemis Openwire RemoveSubscriptionInfo unauthenticated queue deletion](https://junglewise.ai/threats/cve-2026-67593-apache-artemis-openwire-removesubscriptioninfo-unauthenticated)
- [Apache Artemis CORE protocol session reattach authentication bypass](https://junglewise.ai/threats/cve-2026-57967-apache-artemis-core-protocol-session-reattach-authentication)
- [Apache Artemis Java deserialization denial of service in message management](https://junglewise.ai/threats/cve-2026-57822-apache-artemis-java-deserialization-denial-of-service-in-message)