TI-2025-20262 Aliases CVE-2025-27427 GHSA-3w85-5p9g-h334

Apache ActiveMQ Artemis: Address routing-type can be updated by user without the createAddress permission

LOW 13CWE-863Published 2025-04-01 · Updated 2025-04-02

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: Present
Impact type: Security bypass
Confidentiality · integrity · availability: None · Low · None
Fix status: Partial Red Hat: 13 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-863.

Summary

A vulnerability exists in Apache ActiveMQ Artemis whereby a user with the createDurableQueue or createNonDurableQueue permission on an address can augment the routing-type supported by that address even if said user doesn't have the createAddress permission for that particular address. When combined with the send permission and automatic queue creation a user could successfully send a message with a routing-type not supported by the address when that message should actually be rejected on the basis that the user doesn't have permission to change the routing-type of the address. This issue affects Apache ActiveMQ Artemis from 2.0.0 through 2.39.0. Users are recommended to upgrade to version 2.40.0 which fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00653 51st percentileScored 2026-11-07

Fix Partial org.apache.activemq:artemis-server (Maven): 2.40.0Red Hat: 13 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Apache	Apache ActiveMQ Artemis	2.0.0 – 2.39.0	—	No fix listed	CNA
—	org.apache.activemq:artemis-server (Maven)	2.0.0 to before 2.40.0	2.40.0	Patch available	GHSA-3w85-5p9g-h334

Apache ActiveMQ Artemis VendorApache Affected 2.0.0 – 2.39.0 Fixed in — No fix listed CNA
org.apache.activemq:artemis-server (Maven) Vendor— Affected 2.0.0 to before 2.40.0 Fixed in 2.40.0 Patch available GHSA-3w85-5p9g-h334

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:apache:artemis::::::::	2.0.0 to before 2.40.0	Vulnerable	Apache

cpe:2.3:a:apache:artemis:*:*:*:*:*:*:*:* Versions 2.0.0 to before 2.40.0 Vulnerable ·Apache

Remediation

Fix · GHSA-3w85-5p9g-h334 org.apache.activemq:artemis-server (Maven) Fixed in 2.40.0 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

Product	Status	Plan or fix
A-MQ Clients 2	Affected	No fix yet: Fix deferred
Red Hat AMQ Broker 7	Affected	No fix yet: Fix deferred
Red Hat AMQ Clients	Affected	No fix yet: Fix deferred
Red Hat Fuse 7	Affected	No fix yet: Fix deferred
Red Hat Integration Camel K 1	Affected	No fix yet: Fix deferred
Red Hat JBoss Enterprise Application Platform 7	Affected	No fix yet: Fix deferred
Red Hat JBoss Enterprise Application Platform 8	Affected	No fix yet: Fix deferred
Red Hat JBoss Enterprise Application Platform Expansion Pack	Affected	No fix yet: Fix deferred
Red Hat Process Automation 7	Affected	No fix yet: Fix deferred
Red Hat Single Sign-On 7	Affected	No fix yet: Fix deferred
Red Hat build of Apache Camel 4 for Quarkus 3	Affected	No fix yet: Fix deferred
Red Hat build of Apache Camel for Spring Boot 4	Affected	No fix yet: Fix deferred
Red Hat build of OptaPlanner 8	Affected	No fix yet: Fix deferred

Timeline

2026-10-02 Threatist record created from CVE-2025-27427
2026-10-03 Alias added: GHSA-3w85-5p9g-h334
2026-10-23 EPSS moved to the 50th–90th percentile

References

Advisory 3

Other 4

TI-2026-21857 Apache Artemis, Apache ActiveMQ Artemis: Auth bypass for Core downstream federation CVSS 4.0CRITICAL 9.3
TI-2023-27710 Apache ActiveMQ Artemis: Authenticated users could perform RCE via Jolokia MBeans CVSS 3.1HIGH 8.8
TI-2026-41732 Apache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session reattachment CVSS 3.1CRITICAL 9.8
TI-2026-36537 Missing authentication in Apache Artemis CVSS 3.1CRITICAL 9.1
TI-2026-47754 Missing authentication in Apache Artemis CVSS 3.1CRITICAL 9.1
TI-2021-08067 ActiveMQ: LDAP-Authentication does not verify passwords on servers with anonymous bind CVSS 3.1HIGH 7.5

See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences