CVE-2026-27446

9.8

CRITICAL CVSS 3.1

Apache Artemis, Apache ActiveMQ Artemis: Auth bypass for Core downstream federation

Overview

Description

Missing Authentication for Critical Function (CWE-306) vulnerability in Apache Artemis, Apache ActiveMQ Artemis. An unauthenticated remote attacker can use the Core protocol to force a target broker to establish an outbound Core federation connection to an attacker-controlled rogue broker. This could potentially result in message injection into any queue and/or message exfiltration from any queue via the rogue broker. This impacts environments that allow both: - incoming Core protocol connections from untrusted sources to the broker - outgoing Core protocol connections from the broker to untrusted targets This issue affects: - Apache Artemis from 2.50.0 through 2.51.0 - Apache ActiveMQ Artemis from 2.11.0 through 2.44.0. Users are recommended to upgrade to Apache Artemis version 2.52.0, which fixes the issue. The issue can be mitigated by one of the following: - Remove Core protocol support from any acceptor receiving connections from untrusted sources. Incoming Core protocol connections are supported by default via the "artemis" acceptor listening on port 61616. See the "protocols" URL parameter configured for the acceptor. An acceptor URL without this parameter supports all protocols by default, including Core. - Use two-way SSL (i.e. certificate-based authentication) in order to force every client to present the proper SSL certificate when establishing a connection before any message protocol handshake is attempted. This will prevent unauthenticated exploitation of this vulnerability. - Implement and deploy a Core interceptor to deny all Core downstream federation connect packets. Such packets have a type of (int) -16 or (byte) 0xfffffff0. Documentation for interceptors is available at https://artemis.apache.org/components/artemis/documentation/latest/intercepting-operations.html .

Details

INFO

Published Date :

March 4, 2026, 9:15 a.m.

Last Modified :

March 17, 2026, 4:16 p.m.

Remotely Exploit :

Yes !

Source :

[email protected]

Impact

Affected Products

The following products are affected by CVE-2026-27446 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID	Vendor	Product	Action
1	Apache	activemq_artemis
2	Apache	artemis

: Total Affected Vendor : 1 | Products : 2

Scoring

CVSS Scores

The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.

Version	Severity	Source
CVSS 3.1	CRITICAL	[email protected]
CVSS 4.0	CRITICAL	f0158376-9dc2-43b6-827c-5f631a4d8d09
CVSS 4.0	CRITICAL	[email protected]

Solution

Address missing authentication by upgrading or configuring Core protocol security.

Upgrade Apache Artemis to version 2.52.0.
Remove Core protocol support from untrusted acceptors.
Enforce two-way SSL for all connections.

Public PoC/Exploit Available at Github

CVE-2026-27446 has a 2 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

References

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2026-27446.

URL	Resource
https://lists.apache.org/thread/jwpsdc8tdxotm98od8n8n30fqlzoc8gg	Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/03/03/4	Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2026/03/04/1	Mailing List Third Party Advisory

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-27446 is associated with the following CWEs:

CWE-306: Missing Authentication for Critical Function

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-27446 weaknesses.

CAPEC-12: Choosing Message Identifier Choosing Message Identifier CAPEC-36: Using Unpublished Interfaces or Functionality Using Unpublished Interfaces or Functionality CAPEC-62: Cross Site Request Forgery Cross Site Request Forgery CAPEC-166: Force the System to Reset Values Force the System to Reset Values CAPEC-216: Communication Channel Manipulation Communication Channel Manipulation

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

darranl/sca-dashboard

Temporary project to develop a dashboard for the WildFly SCA scanner.

HTML

Updated: 1 week ago

0 stars 0 fork 0 watcher

Born at : March 17, 2026, 4 p.m. This repo has been linked 1 different CVEs too.

FalconEYE-ai/FalconEYE

AI-powered security code analyzer using local LLMs for semantic vulnerability detection. Unlike traditional SAST tools, FalconEYE reasons about code contextually, no pattern matching. Supports Python, JavaScript, TypeScript, Go, Rust, C/C++, Java, and more.

HTML Python

Updated: 1 week ago

44 stars 12 fork 12 watcher

Born at : Dec. 2, 2025, 11:19 a.m. This repo has been linked 1 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-27446 vulnerability anywhere in the article.

Daily CyberSecurity

Integer Overflow Flaw in Apache ActiveMQ Exposes MQTT Brokers to DoS

The Apache Software Foundation has released a security update for Apache ActiveMQ, addressing a significant integer overflow vulnerability in its MQTT transport connector. The flaw, tracked as CVE-202 ...

Published Date: Mar 05, 2026 (2 weeks, 5 days ago)

Results are limited to the first 20 news articles due to potential performance issues.

The following table lists the changes that have been made to the CVE-2026-27446 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

CVE Modified by [email protected]

Mar. 17, 2026

Action	Type	Old Value	New Value
Changed	Description	Missing Authentication for Critical Function (CWE-306) vulnerability in Apache Artemis, Apache ActiveMQ Artemis. An unauthenticated remote attacker can use the Core protocol to force a target broker to establish an outbound Core federation connection to an attacker-controlled rogue broker. This could potentially result in message injection into any queue and/or message exfiltration from any queue via the rogue broker. This impacts environments that allow both: - incoming Core protocol connections from untrusted sources to the broker - outgoing Core protocol connections from the broker to untrusted targets This issue affects: - Apache Artemis from 2.50.0 through 2.51.0 - Apache ActiveMQ Artemis from 2.11.0 through 2.44.0. Users are recommended to upgrade to Apache Artemis version 2.52.0, which fixes the issue. The issue can be mitigated by either of the following: - Remove Core protocol support from any acceptor receiving connections from untrusted sources. Incoming Core protocol connections are supported by default via the "artemis" acceptor listening on port 61616. See the "protocols" URL parameter configured for the acceptor. An acceptor URL without this parameter supports all protocols by default, including Core. - Use two-way SSL (i.e. certificate-based authentication) in order to force every client to present the proper SSL certificate when establishing a connection before any message protocol handshake is attempted. This will prevent unauthenticated exploitation of this vulnerability.	Missing Authentication for Critical Function (CWE-306) vulnerability in Apache Artemis, Apache ActiveMQ Artemis. An unauthenticated remote attacker can use the Core protocol to force a target broker to establish an outbound Core federation connection to an attacker-controlled rogue broker. This could potentially result in message injection into any queue and/or message exfiltration from any queue via the rogue broker. This impacts environments that allow both: - incoming Core protocol connections from untrusted sources to the broker - outgoing Core protocol connections from the broker to untrusted targets This issue affects: - Apache Artemis from 2.50.0 through 2.51.0 - Apache ActiveMQ Artemis from 2.11.0 through 2.44.0. Users are recommended to upgrade to Apache Artemis version 2.52.0, which fixes the issue. The issue can be mitigated by one of the following: - Remove Core protocol support from any acceptor receiving connections from untrusted sources. Incoming Core protocol connections are supported by default via the "artemis" acceptor listening on port 61616. See the "protocols" URL parameter configured for the acceptor. An acceptor URL without this parameter supports all protocols by default, including Core. - Use two-way SSL (i.e. certificate-based authentication) in order to force every client to present the proper SSL certificate when establishing a connection before any message protocol handshake is attempted. This will prevent unauthenticated exploitation of this vulnerability. - Implement and deploy a Core interceptor to deny all Core downstream federation connect packets. Such packets have a type of (int) -16 or (byte) 0xfffffff0. Documentation for interceptors is available at https://artemis.apache.org/components/artemis/documentation/latest/intercepting-operations.html .

Initial Analysis by [email protected]

Mar. 11, 2026

Action	Type	New Value
Added	CVSS V3.1	AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Added	CPE Configuration	OR cpe:2.3:a:apache:activemq_artemis::::::::* versions from (including) 2.11.0 up to (including) 2.44.0 cpe:2.3:a:apache:artemis:2.50.0:::::::
Added	Reference Type	CVE: http://www.openwall.com/lists/oss-security/2026/03/03/4 Types: Mailing List, Third Party Advisory
Added	Reference Type	CVE: http://www.openwall.com/lists/oss-security/2026/03/04/1 Types: Mailing List, Third Party Advisory
Added	Reference Type	Apache Software Foundation: https://lists.apache.org/thread/jwpsdc8tdxotm98od8n8n30fqlzoc8gg Types: Mailing List, Vendor Advisory

CVE Modified by af854a3a-2127-422b-91ae-364da2661108

Mar. 05, 2026

Action	Type	Old Value	New Value
Added	Reference		http://www.openwall.com/lists/oss-security/2026/03/03/4