Apache Artemis Stomp Protocol STOMP Protocol authorization

Summaryinfo

A vulnerability marked as critical has been reported in Apache Artemis Stomp Protocol and ActiveMQ Artemis Stomp Protocol. This issue affects some unknown processing of the component STOMP Protocol Handler. The manipulation leads to authorization. This vulnerability is referenced as CVE-2026-40914. Remote exploitation of the attack is possible. No exploit is available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in Apache Artemis Stomp Protocol and ActiveMQ Artemis Stomp Protocol (the affected version is unknown) and classified as critical. This issue affects an unknown code of the component STOMP Protocol Handler. The manipulation with an unknown input leads to a authorization vulnerability. Using CWE to declare the problem leads to CWE-863. The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

A vulnerability exists in Apache Artemis whereby an application using the STOMP protocol with security credentials that grant either the consume or send permission on an address can augment the routing-type supported by that address even if said user doesn't have the createAddress permission for that particular address. A user could successfully send a message to an address or consume a message from a queue with a routing-type not supported by the corresponding address when that operation should actually be rejected on the basis that the user doesn't have permission to change the routing-type of the address. Even though the user was already granted permission to send and/or consume messages, they should not be able to augment the routing-type of the address without the createAddress permission. This issue affects Apache Artemis: from 2.50.0 through 2.53.0; Apache ActiveMQ Artemis: from 2.0.0 through 2.44.0. Users are recommended to upgrade to version 2.54.0, which fixes the issue.

It is possible to read the advisory at lists.apache.org. The identification of this vulnerability is CVE-2026-40914 since 04/15/2026. The exploitation is known to be easy. The attack may be initiated remotely. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 06/15/2026).

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-32894). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Application Server Software

Vendor

• Apache

Name

• ActiveMQ Artemis Stomp Protocol
• Artemis Stomp Protocol

License

• open-source

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion