Credential Exposure in Apache Artemis and ActiveMQ by Apache
CVE-2026-49364

Currently unrated

Key Information:

Vendor: Apache
Status: Apache Artemis; Apache ActiveMQ Artemis
Vendor: CVE Published:; 10 September 2026

What is CVE-2026-49364?

An unauthenticated network-adjacent attacker can exploit a weakness during the initial cluster connection handshake, leading to the capture of critical cluster administrative credentials. This vulnerability impacts specific versions of Apache Artemis and ActiveMQ Artemis, necessitating urgent upgrades to version 2.57.0 to mitigate risks.

Affected Version(s)

Apache ActiveMQ Artemis 1.0.0 <= 2.44.0

Apache Artemis 2.50.0 <= 2.56.0

References

https://lists.apache.org/thread/4qbgcz3k38q30bfbf7hphtomr...

vendor-advisory

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Sep 10, 2026
Vulnerability Reserved
May 29, 2026

Credit

Domenico Francesco Bruscino

CVE-2026-49364 Data

JSON