Executive brief
Apache ActiveMQ Artemis, a popular open-source message broker used for high-performance messaging, is vulnerable to an authentication bypass. An unauthenticated attacker can trick the system into connecting to a malicious server, allowing them to steal sensitive messages or inject fraudulent data into the system's queues. This could lead to significant data breaches or the disruption of business-critical automated workflows.
Technical details
A Missing Authentication for Critical Function (CWE-306) vulnerability exists in the Core protocol implementation of Apache Artemis and ActiveMQ Artemis. An unauthenticated remote attacker can send specific Core protocol packets to force the target broker to initiate an outbound Core federation connection to an attacker-controlled rogue broker. Once the federation is established, the attacker can exfiltrate messages from any queue or inject arbitrary messages into the system. The vulnerability is exploitable if the broker accepts incoming Core protocol connections from untrusted sources and is permitted to make outgoing Core connections. Mitigation involves upgrading to version 2.52.0, implementing two-way SSL, or using Core interceptors to block downstream federation connect packets (type -16).
Affected products
- Apache Artemis 2.50.0 through 2.51.0
- Apache ActiveMQ Artemis 2.11.0 through 2.44.0
- Siemens Opcenter RDnL All versions using affected Apache Artemis versions
Timeline
- 2026-03-03: disclosed: Initial disclosure on oss-security mailing list
- 2026-03-04: advisory: NVD publication date
- 2026-05-12: advisory: Siemens published downstream advisory SSA-085541 for Opcenter RDnL