4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-40914

CVE-2026-40914: Apache Artemis Stomp Protocol, Apache ActiveMQ Artemis Stomp Protocol: Address routing-type can be updated by STOMP protocol user without the createAddress permission

A vulnerability exists in Apache Artemis whereby an application using the STOMP protocol with security credentials that grant either the consume or send permission on an address can augment the routing-type supported by that address even if said user doesn't have the createAddress permission for that particular address. A user could successfully send a message to an address or consume a message from a queue with a routing-type not supported by the corresponding address when that operation should actually be rejected on the basis that the user doesn't have permission to change the routing-type of the address. Even though the user was already granted permission to send and/or consume messages, they should not be able to augment the routing-type of the address without the createAddress permission.

This issue affects Apache Artemis: from 2.50.0 through 2.53.0; Apache ActiveMQ Artemis: from 2.0.0 through 2.44.0.

Users are recommended to upgrade to version 2.54.0, which fixes the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-40914

CVE-2026-40914:

4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.apache.artemis:artemis-stomp-protocol	maven	>= 2.50.0, <= 2.53.0	2.54.0
org.apache.artemis:artemis-stomp-protocol	maven	>= 2.0.0, <= 2.44.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability allowed users with send or consume permissions on a STOMP address to alter its routing-type, an action that should require the createAddress permission. The root cause was in the STOMP protocol implementation, which had its own logic for auto-creating and updating addresses.

The analysis of the patch 53173375c4d5e4b57890e89d37ed8b666c974474 reveals that the method org.apache.activemq.artemis.core.protocol.stomp.StompConnection.autoCreateDestinationIfPossible contained the flawed logic. This method would add a new routing-type to an existing address if the user-provided type was not already supported, without verifying if the user had createAddress permission.

This vulnerable method was called from two places:

org.apache.activemq.artemis.core.protocol.stomp.VersionedStompFrameHandler.onSend when a client sent a message (requiring send permission).
org.apache.activemq.artemis.core.protocol.stomp.StompConnection.subscribe when a client subscribed to a destination (requiring consume permission).

The fix refactored the code to remove the custom, insecure implementation and instead use the centralized ServerSession.checkAutoCreate method, which correctly enforces security permissions. Therefore, the identified functions are the ones that would appear in a runtime profile when the vulnerability is exploited, either by sending a message or subscribing with a crafted STOMP frame specifying a different routing type.

Vulnerable functions

org.apache.activemq.artemis.core.protocol.stomp.StompConnection.autoCreateDestinationIfPossible

artemis-protocols/artemis-stomp-protocol/src/main/java/org/apache/activemq/artemis/core/protocol/stomp/StompConnection.java

This function was responsible for auto-creating destinations. It would check if an address existed, and if not, create it. If the address existed but with a different routing type than requested, it would update the address to add the new routing type. This was done without checking if the user had the `createAddress` permission, leading to an incorrect authorization vulnerability. A user with only `send` or `consume` permission could alter the address configuration. The entire function was removed as part of the fix.

org.apache.activemq.artemis.core.protocol.stomp.VersionedStompFrameHandler.onSend

artemis-protocols/artemis-stomp-protocol/src/main/java/org/apache/activemq/artemis/core/protocol/stomp/VersionedStompFrameHandler.java

This function is the entry point for handling STOMP `SEND` frames. It was calling the vulnerable `autoCreateDestinationIfPossible` function, which allowed a user with `send` permission to modify the routing type of an address without having the necessary `createAddress` permission. The fix replaces the call to the vulnerable function with a call to `checkAutoCreate`, which performs the proper authorization checks.

org.apache.activemq.artemis.core.protocol.stomp.StompConnection.subscribe

artemis-protocols/artemis-stomp-protocol/src/main/java/org/apache/activemq/artemis/core/protocol/stomp/StompConnection.java

This function handles STOMP `SUBSCRIBE` frames. It was calling the vulnerable `autoCreateDestinationIfPossible` function, which allowed a user with `consume` permission to modify the routing type of an address without having the necessary `createAddress` permission. The fix replaces the call to the vulnerable function with a call to `checkAutoCreate`, which performs the proper authorization checks.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.