Executive brief
Apache ActiveMQ Artemis is a high-performance message broker used to manage data communication between different software applications. A security flaw allows certain authorized users to bypass restrictions and create temporary message addresses they should not have permission to create. While these addresses are removed when the user disconnects, this represents a failure in the system's access control rules.
Technical details
An incorrect authorization vulnerability (CWE-863) exists in the OpenWire protocol implementation of Apache Artemis. The flaw occurs when an authenticated user with 'createDurableQueue' permissions, but lacking 'createAddress' permissions, attempts to create a non-durable JMS topic subscription on a non-existent address while auto-creation is disabled. Instead of failing as expected, the system incorrectly creates a temporary address for the subscription. This address persists until the OpenWire connection is terminated. The issue is resolved in version 2.53.0.
Affected products
- Apache Artemis 2.50.0 through 2.52.0
- Apache ActiveMQ Artemis 2.0.0 through 2.44.0
Timeline
- 2026-03-20: disclosed: Initial disclosure on oss-security mailing list
- 2026-03-24: advisory: NVD publication date