CVE-2026-27446 is a critical (CVSS 9.8) missing authentication flaw in Apache Artemis and ActiveMQ Artemis. An unauthenticated attacker can use the Core protocol to make a broker open an outbound federation connection to a rogue broker. Upgrade to 2.52.0, or apply one of the listed mitigations.
What's affected
Apache Artemis 2.50.0 through 2.51.0, and Apache ActiveMQ Artemis 2.11.0 through 2.44.0. Apache recommends 2.52.0.
The risk applies where both of these are true: the broker accepts incoming Core protocol connections from untrusted sources, and it allows outgoing Core connections to untrusted targets.
How to check if you're exposed
Look at your acceptors in the broker configuration:
grep -n acceptor etc/broker.xml
The default artemis acceptor listens on port 61616 and supports all protocols, including Core, unless a protocols parameter limits it. Check who can reach that port, and what outbound connections the broker host may make.
What to do now
- Upgrade to Apache Artemis 2.52.0.
- If you cannot upgrade yet, remove Core support from acceptors that take connections from untrusted sources, using the protocols URL parameter.
- Or require two way SSL so every client presents a certificate before any message protocol handshake.
- Or deploy a Core interceptor that denies downstream federation connect packets, as the advisory describes.
- Limit outbound network access from the broker to the peers it should reach.
Why it matters
The weakness is CWE-306, missing authentication for a critical function. Federation lets brokers pull from one another, and the connect request was honored without any check on who asked. The result, per the advisory, could be messages injected into any queue or taken from any queue via the rogue broker.
Message brokers carry business data between systems, so a quiet redirect of traffic is hard to notice. The record does not mark this CVE as known exploited.
Quick check
Which mitigation needs no upgrade?
Any one of three: drop Core from untrusted acceptors, require two way SSL, or deploy an interceptor that denies Core downstream federation connect packets.
Sources
- CVE-2026-27446 on Gold
- Apache announcement listed in the record: https://lists.apache.org/thread/jwpsdc8tdxotm98od8n8n30fqlzoc8gg
- oss-security post listed in the record: http://www.openwall.com/lists/oss-security/2026/03/03/4
Last reviewed: 19 October 2026.
