ActiveMQ: LDAP-Authentication does not verify passwords on servers with anonymous bind
Priority MEDIUM 46CWE-287Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-287.
Summary
The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server. In this case, for Apache ActiveMQ Artemis prior to version 2.16.0 and Apache ActiveMQ prior to versions 5.16.1 and 5.15.14, the anonymous context is used to verify a valid users password in error, resulting in no check on the password.
Why it matters now
EPSS 0.1133 96th percentileScored 2026-11-07
Fix Fixed Apache ActiveMQ (Apache Software Foundation): 2.16.0, 5.16.1org.apache.activemq:activemq-parent (Maven): 5.16.1, 5.15.14+1 more productRed Hat: 3 advisories
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache ActiveMQ | Apache ActiveMQ Artemis to before 2.16.0; Apache ActiveMQ to before 5.16.1 | 2.16.0, 5.16.1 | Patch available | CNA |
| — | org.apache.activemq:activemq-parent (Maven) | 5.16.0 to before 5.16.1 | 5.16.1 | Patch available | GHSA-9mgm-gcq8-86wq |
| — | org.apache.activemq:activemq-parent (Maven) | before 5.15.14 | 5.15.14 | Patch available | GHSA-9mgm-gcq8-86wq |
| — | org.apache.activemq:apache-artemis (Maven) | before 2.16.0 | 2.16.0 | Patch available | GHSA-9mgm-gcq8-86wq |
- Apache ActiveMQ VendorApache Affected Apache ActiveMQ Artemis to before 2.16.0; Apache ActiveMQ to before 5.16.1 Fixed in 2.16.0, 5.16.1 Patch available CNA
- org.apache.activemq:activemq-parent (Maven) Vendor— Affected 5.16.0 to before 5.16.1 Fixed in 5.16.1 Patch available GHSA-9mgm-gcq8-86wq
- org.apache.activemq:activemq-parent (Maven) Vendor— Affected before 5.15.14 Fixed in 5.15.14 Patch available GHSA-9mgm-gcq8-86wq
- org.apache.activemq:apache-artemis (Maven) Vendor— Affected before 2.16.0 Fixed in 2.16.0 Patch available GHSA-9mgm-gcq8-86wq
CPE configurations NVD · 9
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:* | 5.15.0 to before 5.15.14; 5.16.0 to before 5.16.1 | Vulnerable | Apache |
| cpe:2.3:a:apache:artemis:*:*:*:*:*:*:*:* | before 2.16.0 | Vulnerable | Apache |
| cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:a:oracle:communications_element_manager:*:*:*:*:*:*:*:* | 8.2.0 – 8.2.4.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_session_report_manager:*:*:*:*:*:*:*:* | 8.2.0 – 8.2.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_session_route_manager:*:*:*:*:*:*:*:* | 8.0.0 – 8.2.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:flexcube_private_banking:12.0.0:*:*:*:*:*:*:* | 12.0.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:flexcube_private_banking:12.1.0:*:*:*:*:*:*:* | 12.1.0 | Vulnerable | Oracle |
- cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:* Versions 5.15.0 to before 5.15.14; 5.16.0 to before 5.16.1 Vulnerable ·Apache
- cpe:2.3:a:apache:artemis:*:*:*:*:*:*:*:* Versions before 2.16.0 Vulnerable ·Apache
- cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:a:oracle:communications_element_manager:*:*:*:*:*:*:*:* Versions 8.2.0 – 8.2.4.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_session_report_manager:*:*:*:*:*:*:*:* Versions 8.2.0 – 8.2.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_session_route_manager:*:*:*:*:*:*:*:* Versions 8.0.0 – 8.2.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:flexcube_private_banking:12.0.0:*:*:*:*:*:*:* Versions 12.0.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:flexcube_private_banking:12.1.0:*:*:*:*:*:*:* Versions 12.1.0 Vulnerable ·Oracle
Remediation
- Fix · CNA Apache ActiveMQ (Apache Software Foundation) Fixed in 2.16.0, 5.16.1
- Fix · GHSA-9mgm-gcq8-86wq org.apache.activemq:activemq-parent (Maven) Fixed in 5.16.1 Advisory →
- Fix · GHSA-9mgm-gcq8-86wq org.apache.activemq:activemq-parent (Maven) Fixed in 5.15.14 Advisory →
- Fix · GHSA-9mgm-gcq8-86wq org.apache.activemq:apache-artemis (Maven) Fixed in 2.16.0 Advisory →
Red Hat 3 advisories
- RHSA-2021:0384 Released 2021-02-02 · Red Hat rating ImportantRed Hat JBoss Fuse/A-MQ 6.3 R18 security and bug fix update
- Red Hat Fuse/AMQ 6.3.18
- RHSA-2020:5365 Released 2020-12-08 · Red Hat rating ModerateRed Hat AMQ Broker 7.8 release and security update
- Red Hat AMQ
- RHSA-2020:4154 Released 2020-10-01 · Red Hat rating ModerateRed Hat AMQ Broker 7.4.5 release and security update
- Red Hat AMQ
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat AMQ | Fixed | RHSA-2020:4154 |
| Red Hat Fuse/AMQ 6.3.18 | Fixed | RHSA-2021:0384 |
Timeline
- 2026-10-02 Threatist record created from CVE-2021-26117
- 2026-10-03 Alias added: GHSA-9mgm-gcq8-86wq
References
Patch 2
Advisory 4
Other 36
- https://mail-archives.apache.org/mod_mbox/activemq-users/202101.mbox/%3cCAH+vQmMeUEiKN4wYX9nLBbqmFZFPXqajNvBKmzb2V8QZANcSTA%40mail.gmail.com%3e
- [activemq-commits] 20210128 [activemq-website] branch master updated: CVE-2021-26117 - add mitigation section
- [announce] 20210128 CVE-2021-26117: ActiveMQ: LDAP-Authentication does not verify passwords on servers with anonymous bind
- [activemq-commits] 20210208 [activemq-website] branch master updated: Publish CVE-2020-13947
- [activemq-gitbox] 20210323 [GitHub] [activemq-artemis] trevorlinton opened a new pull request #3515: Update activmq5 version to fix CVE-2021-26117
- [activemq-gitbox] 20210409 [GitHub] [activemq-artemis] brusdev commented on pull request #3515: Update activmq5 version to fix CVE-2021-26117
- [activemq-gitbox] 20210409 [GitHub] [activemq-artemis] brusdev closed pull request #3515: Update activmq5 version to fix CVE-2021-26117
- [activemq-issues] 20210421 [jira] [Updated] (AMQ-8246) CVE-2021-26117 still exists on 5.16.1
- [activemq-issues] 20210421 [jira] [Created] (AMQ-8244) CVE-2021-26117 on AMQ 5.16.1
- [activemq-issues] 20210421 [jira] [Created] (AMQ-8245) CVE-2021-26117 on AMQ 5.16.1
- [activemq-issues] 20210421 [jira] [Created] (AMQ-8246) CVE-2021-26117 still exists on 5.16.1
- [activemq-issues] 20210509 [jira] [Commented] (AMQ-8246) CVE-2021-26117 still exists on 5.16.1
- [activemq-issues] 20210509 [jira] [Deleted] (AMQ-8244) CVE-2021-26117 on AMQ 5.16.1
- [activemq-issues] 20210509 [jira] [Deleted] (AMQ-8245) CVE-2021-26117 on AMQ 5.16.1
- [activemq-issues] 20210421 [jira] [Updated] (AMQ-8246) CVE-2021-26117 still exists on 5.16.1
- [debian-lts-announce] 20231120 [SECURITY] [DLA 3657-1] activemq security update
- https://github.com/apache/activemq/commit/46a774c
- https://github.com/apache/activemq/commit/73e291693d59a96c0054fc7e7e09c2c67b192911
- https://issues.apache.org/jira/browse/AMQ-8035
- https://lists.apache.org/thread.html/rd05b1c9d61dbd220664d559aa0e2b55e5830f006a09e82057f3f7863@%3Cissues.activemq.apache.org%3E
- https://lists.apache.org/thread.html/rd75600cee29cb248d548edcf6338fe296466d63a69e2ed0afc439ec7@%3Cissues.activemq.apache.org%3E
- https://lists.apache.org/thread.html/re1b98da90a5f2e1c2e2d50e31c12e2578d61fe01c0737f9d0bd8de99@%3Cannounce.apache.org%3E
- https://lists.apache.org/thread.html/rec93794f8aeddf8a5f1a643d264b4e66b933f06fd72a38f31448f0ac@%3Cgitbox.activemq.apache.org%3E
- https://lists.apache.org/thread.html/rffa5cd05d01c4c9853b17f3004d80ea6eb8856c422a8545c5f79b1a6@%3Ccommits.activemq.apache.org%3E
- https://mail-archives.apache.org/mod_mbox/activemq-users/202101.mbox/%3cCAH+vQmMeUEiKN4wYX9nLBbqmFZFPXqajNvBKmzb2V8QZANcSTA@mail.gmail.com%3e
- https://security.netapp.com/advisory/ntap-20210304-0008
- https://issues.apache.org/jira/browse/ARTEMIS-2895
- https://lists.apache.org/thread.html/r110cacfa754471361234965ffe851a046e302ff2693b055f49f47b02@%3Cissues.activemq.apache.org%3E
- https://lists.apache.org/thread.html/r22cdc0fb45e223ac92bc2ceff7af92f1193dfc614c8b248534456229@%3Cissues.activemq.apache.org%3E
- https://lists.apache.org/thread.html/r3341d96d8f956e878fb7b463b08d57ca1d58fec9c970aee929b58e0d@%3Cissues.activemq.apache.org%3E
- https://lists.apache.org/thread.html/r519bfafd67091d0b91243efcb1c49b1eea27321355ba5594f679277d@%3Cissues.activemq.apache.org%3E
- https://lists.apache.org/thread.html/r5899ece90bcae5805ad6142fdb05c58595cff19cb2e98cc58a91f55b@%3Cgitbox.activemq.apache.org%3E
- https://lists.apache.org/thread.html/r70389648227317bdadcdecbd9f238571a6047469d156bd72bb0ca2f7@%3Cgitbox.activemq.apache.org%3E
- https://lists.apache.org/thread.html/r946488fb942fd35c6a6e0359f52504a558ed438574a8f14d36d7dcd7@%3Ccommits.activemq.apache.org%3E
- https://lists.apache.org/thread.html/ra255ddfc8b613b80e9fa22ff3e106168b245f38a22316bfb54d21159@%3Cissues.activemq.apache.org%3E
- https://lists.apache.org/thread.html/raea451de09baed76950d6a60cc4bb1b74476c505e03205a3c68c9808@%3Cissues.activemq.apache.org%3E
More Apache Activemq vulnerabilities
- TI-2023-25106 Deserialization of untrusted data in Apache ActiveMQ KEVCVSS 3.1CRITICAL 10.0
- TI-2016-02587 The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote… KEVCVSS 3.1CRITICAL 9.8
- TI-2026-26494 Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans KEVCVSS 3.1HIGH 8.8
- TI-2013-05951 Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not… CVSS 3.1CRITICAL 9.8
- TI-2021-04451 XStream is vulnerable to an Arbitrary Code Execution attack CVSS 3.1CRITICAL 9.1
- TI-2021-04446 XStream is vulnerable to an Arbitrary Code Execution attack CVSS 3.1CRITICAL 9.8
Sources
- CVE-2021-26117 · CVE Program
- CVE-2021-26117 · NVD
- FIRST EPSS
- GHSA-9mgm-gcq8-86wq · GitHub Advisory Database · CC BY 4.0
- CVE-2021-26117 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences