Missing Authentication in Apache Artemis and ActiveMQ Messaging Services

CVE-2026-27446

What is CVE-2026-27446?

A vulnerability in Apache Artemis and Apache ActiveMQ Artemis allows unauthenticated remote attackers to exploit the Core protocol, compelling a broker to establish outbound federations to attacker-controlled brokers. This scenario raises significant risks for message integrity, enabling potential message injection or exfiltration. The issue chiefly affects environments permitting incoming connections from untrusted sources and outgoing connections to untrusted targets. To mitigate this, it is crucial to either disable Core protocol support for untrusted acceptors or implement two-way SSL for secure, certificate-based authentication across client connections. Users are advised to upgrade to version 2.52.0 for enhanced security.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References