9.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-27446

CVE-2026-27446: Apache Artemis, Apache ActiveMQ Artemis: Auth bypass for Core downstream federation

Missing Authentication for Critical Function (CWE-306) vulnerability in Apache Artemis, Apache ActiveMQ Artemis. An unauthenticated remote attacker can use the Core protocol to force a target broker to establish an outbound Core federation connection to an attacker-controlled rogue broker. This could potentially result in message injection into any queue and/or message exfiltration from any queue via the rogue broker. This impacts environments that allow both:

incoming Core protocol connections from untrusted sources to the broker
outgoing Core protocol connections from the broker to untrusted targets

This issue affects:

Apache Artemis from 2.50.0 through 2.51.0
Apache ActiveMQ Artemis from 2.11.0 through 2.44.0.

Users are recommended to upgrade to Apache Artemis version 2.52.0, which fixes the issue.

The issue can be mitigated by one of the following:

Remove Core protocol support from any acceptor receiving connections from untrusted sources. Incoming Core protocol connections are supported by default via the "artemis" acceptor listening on port 61616. See the "protocols" URL parameter configured for the acceptor. An acceptor URL without this parameter supports all protocols by default, including Core.
Use two-way SSL (i.e. certificate-based authentication) in order to force every client to present the proper SSL certificate when establishing a connection before any message protocol handshake is attempted. This will prevent unauthenticated exploitation of this vulnerability.
Implement and deploy a Core interceptor to deny all Core downstream federation connect packets. Such packets have a type of (int) -16 or (byte) 0xfffffff0. Documentation for interceptors is available at https://artemis.apache.org/components/artemis/documentation/latest/intercepting-operations.html .

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-27446

CVE-2026-27446:

9.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.apache.activemq:artemis-server	maven	>= 2.11.0, <= 2.44.0
org.apache.artemis:artemis-server	maven	>= 2.50.0, < 2.52.0	2.52.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the handling of Core protocol packets for federation. Specifically, the packet type FEDERATION_DOWNSTREAM_CONNECT was processed without any security checks. An unauthenticated attacker could send this packet to a vulnerable broker, which would then establish a federation connection to an attacker-controlled broker. This could be exploited for message injection or exfiltration.

The patch addresses this by introducing a dedicated channel handler, FederationChannelHandler, for federation-related packets. The handlePacket method within this new handler now performs authentication and authorization checks before processing FEDERATION_DOWNSTREAM_CONNECT packets. It verifies that the user is authenticated and has the required role to perform this action. The vulnerable code, which was previously in the LocalChannelHandler inner class within CoreProtocolManager, has been removed and replaced with this more secure implementation. The vulnerable function is therefore org.apache.activemq.artemis.core.protocol.core.impl.CoreProtocolManager$LocalChannelHandler.handlePacket as it was the one processing the malicious packet without validation.

Vulnerable functions

org.apache.activemq.artemis.core.protocol.core.impl.CoreProtocolManager$LocalChannelHandler.handlePacket

artemis-server/src/main/java/org/apache/activemq/artemis/core/protocol/core/impl/CoreProtocolManager.java

This function, part of an inner class, was responsible for handling various packet types. It contained a logic block to handle `FEDERATION_DOWNSTREAM_CONNECT` packets. This logic block did not perform any authentication or authorization checks before processing the request to create a federation connection. An unauthenticated remote attacker could send a crafted packet of this type to force the broker to connect to a malicious broker, leading to potential message injection or exfiltration.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.