CVE-2026-49364 in ActiveMQ Artemis
Summary
by MITRE • 09/10/2026
An unauthenticated network-adjacent attacker can leverage discovery to capture cluster administrative credentials during the initial cluster connection handshake.
This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0.
Users are recommended to upgrade to version 2.57.0, which fixes the issue.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability described involves a critical authentication bypass within the initial handshake protocol of Apache ActiveMQ Artemis and its predecessor, Apache Artemis. This flaw allows an unauthenticated attacker who is network-adjacent to intercept sensitive administrative credentials during the cluster connection process. The security architecture relies on secure credential exchange mechanisms that are compromised in versions ranging from 1.0.0 through 2.44.0 for ActiveMQ Artemis and 2.50.0 through 2.56.0 for Apache Artemis. By exploiting this weakness, an adversary can capture plaintext or weakly protected credentials without needing prior valid authentication tokens, effectively bypassing the intended access control layers of the messaging broker infrastructure.
From a technical perspective, the flaw resides in how the cluster handshake negotiates identity and security parameters. During the initial connection phase, the server may transmit administrative credential hashes or clear-text passwords as part of the discovery process if specific configuration conditions are met or due to implementation errors in the protocol handler. This exposure occurs before any mutual authentication is fully established, leaving a window where network sniffing tools can capture these sensitive data packets. The vulnerability aligns with CWE-287, which classifies improper authentication mechanisms that fail to verify identity correctly, and specifically relates to CWE-319 regarding cleartext transmission of sensitive information over an unencrypted channel if TLS is not enforced or properly configured during the handshake phase.
The operational impact of this vulnerability is severe for organizations relying on these messaging brokers for enterprise integration. Administrative credentials provide full control over the message broker, including the ability to create destinations, manage users, and potentially execute remote code depending on subsequent exploitation paths. An attacker who captures these credentials can gain persistent access to the system, leading to data exfiltration, service disruption through denial of service attacks, or further lateral movement within the internal network. This aligns with MITRE ATT&CK technique T1078, Valid Accounts, where attackers use legitimate account credentials to maintain persistence and evade detection by blending in with normal administrative activity.
Mitigation strategies prioritize immediate version upgrades as the primary defense vector. Users must upgrade Apache ActiveMQ Artemis to version 2.57.0 or later and Apache Artemis to a patched release beyond 2.56.0, where this handshake flaw has been resolved. In environments where upgrading is not immediately feasible, administrators should enforce strict network segmentation to limit access to the broker ports from untrusted networks. Additionally, ensuring that Transport Layer Security (TLS) is enabled for all cluster connections can mitigate the risk of credential interception by encrypting the handshake traffic, although this does not fix the underlying logical flaw and may still be vulnerable if certificate validation is weak or misconfigured. Regular auditing of network logs for unusual connection attempts during discovery phases should also be implemented to detect potential exploitation activities in real-time.