TI-2025-20226 Aliases CVE-2025-27391 GHSA-pm4j-p7pm-fpvx

Apache ActiveMQ Artemis: Passwords leaking from broker properties in the debug log

LOW 30CWE-532Published 2025-04-09 · Updated 2025-04-09

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: Present
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Partial Red Hat: 13 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-532.

Summary

Insertion of Sensitive Information into Log File vulnerability in Apache ActiveMQ Artemis. All the values of the broker properties are logged when the org.apache.activemq.artemis.core.config.impl.ConfigurationImpl logger has the debug level enabled. This issue affects Apache ActiveMQ Artemis: from 1.5.1 before 2.40.0. It can be mitigated by restricting log access to only trusted users. Users are recommended to upgrade to version 2.40.0, which fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00443 38th percentileScored 2026-11-07

Fix Partial Apache ActiveMQ Artemis (Apache Software Foundation): 2.40.0org.apache.activemq:artemis-project (Maven): 2.40.0Red Hat: 13 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Apache	Apache ActiveMQ Artemis	1.5.1 to before 2.40.0	2.40.0	Patch available	CNA
—	org.apache.activemq:artemis-project (Maven)	1.5.1 to before 2.40.0	2.40.0	Patch available	GHSA-pm4j-p7pm-fpvx

Apache ActiveMQ Artemis VendorApache Affected 1.5.1 to before 2.40.0 Fixed in 2.40.0 Patch available CNA
org.apache.activemq:artemis-project (Maven) Vendor— Affected 1.5.1 to before 2.40.0 Fixed in 2.40.0 Patch available GHSA-pm4j-p7pm-fpvx

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:apache:artemis::::::::	1.5.1 to before 2.40.0	Vulnerable	Apache

cpe:2.3:a:apache:artemis:*:*:*:*:*:*:*:* Versions 1.5.1 to before 2.40.0 Vulnerable ·Apache

Remediation

Fix · CNA Apache ActiveMQ Artemis (Apache Software Foundation) Fixed in 2.40.0
Fix · GHSA-pm4j-p7pm-fpvx org.apache.activemq:artemis-project (Maven) Fixed in 2.40.0 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
A-MQ Clients 2	Affected	No fix yet: Fix deferred
Red Hat AMQ Broker 7	Affected	No fix yet: Fix deferred
Red Hat AMQ Clients	Affected	No fix yet: Fix deferred
Red Hat Fuse 7	Affected	No fix yet: Fix deferred
Red Hat Integration Camel K 1	Affected	No fix yet: Fix deferred
Red Hat JBoss Enterprise Application Platform 7	Affected	No fix yet: Fix deferred
Red Hat JBoss Enterprise Application Platform 8	Affected	No fix yet: Fix deferred
Red Hat JBoss Enterprise Application Platform Expansion Pack	Affected	No fix yet: Fix deferred
Red Hat Process Automation 7	Affected	No fix yet: Fix deferred
Red Hat Single Sign-On 7	Affected	No fix yet: Fix deferred
Red Hat build of Apache Camel 4 for Quarkus 3	Affected	No fix yet: Fix deferred
Red Hat build of Apache Camel for Spring Boot 4	Affected	No fix yet: Fix deferred
Red Hat build of OptaPlanner 8	Affected	No fix yet: Fix deferred

Timeline

2026-10-02 Threatist record created from CVE-2025-27391
2026-10-03 Alias added: GHSA-pm4j-p7pm-fpvx

References

Advisory 3

Other 1

https://github.com/apache/activemq-artemis

TI-2026-21857 Apache Artemis, Apache ActiveMQ Artemis: Auth bypass for Core downstream federation CVSS 4.0CRITICAL 9.3
TI-2023-27710 Apache ActiveMQ Artemis: Authenticated users could perform RCE via Jolokia MBeans CVSS 3.1HIGH 8.8
TI-2026-41732 Apache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session reattachment CVSS 3.1CRITICAL 9.8
TI-2026-36537 Missing authentication in Apache Artemis CVSS 3.1CRITICAL 9.1
TI-2026-47754 Missing authentication in Apache Artemis CVSS 3.1CRITICAL 9.1
TI-2021-08067 ActiveMQ: LDAP-Authentication does not verify passwords on servers with anonymous bind CVSS 3.1HIGH 7.5

See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences