Summaryinfo

A vulnerability has been found in Apache Artemis and ActiveMQ Artemis on OpenWire and classified as critical. Impacted is an unknown function of the component OpenWire Consumer Handler. The manipulation leads to permission. This vulnerability is listed as CVE-2026-32642. The attack may be initiated remotely. There is no available exploit. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in Apache Artemis and ActiveMQ Artemis on OpenWire (the affected version unknown). It has been rated as critical. This issue affects an unknown part of the component OpenWire Consumer Handler. The manipulation with an unknown input leads to a permission vulnerability. Using CWE to declare the problem leads to CWE-275. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Incorrect Authorization (CWE-863) vulnerability in Apache Artemis, Apache ActiveMQ Artemis exists when an application using the OpenWire protocol attempts to create a non-durable JMS topic subscription on an address that doesn't exist with an authenticated user which has the "createDurableQueue" permission but does not have the "createAddress" permission and address auto-creation is disabled. In this circumstance, a temporary address will be created whereas the attempt to create the non-durable subscription should instead fail since the user is not authorized to create the corresponding address. When the OpenWire connection is closed the address is removed. This issue affects Apache Artemis: from 2.50.0 through 2.52.0; Apache ActiveMQ Artemis: from 2.0.0 through 2.44.0. Users are recommended to upgrade to version 2.53.0, which fixes the issue.

The advisory is shared at lists.apache.org. The identification of this vulnerability is CVE-2026-32642. The exploitation is known to be easy. The attack may be initiated remotely. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 03/30/2026). MITRE ATT&CK project uses the attack technique T1222 for this issue.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the databases at EUVD (EUVD-2026-14782) and CERT Bund (WID-SEC-2026-0816). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Affected

• Apache ActiveMQ

Productinfo

Type

• Application Server Software

Vendor

• Apache

Name

• ActiveMQ Artemis
• Artemis

License

• open-source

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion