TI-2026-25151 Aliases CVE-2026-32642 GHSA-f4gc-mwrg-q36r

Incorrect authorization in Apache Artemis

LOW 12CWE-863Published 2026-03-24 · Updated 2026-03-24

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: Present
Impact type: Security bypass
Confidentiality · integrity · availability: None · Low · None
Fix status: Partial Red Hat: 1 fixed, 10 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-863.

Summary

Incorrect Authorization (CWE-863) vulnerability in Apache Artemis, Apache ActiveMQ Artemis exists when an application using the OpenWire protocol attempts to create a non-durable JMS topic subscription on an address that doesn't exist with an authenticated user which has the "createDurableQueue" permission but does not have the "createAddress" permission and address auto-creation is disabled. In this circumstance, a temporary address will be created whereas the attempt to create the non-durable subscription should instead fail since the user is not authorized to create the corresponding address. When the OpenWire connection is closed the address is removed. This issue affects Apache Artemis: from 2.50.0 through 2.52.0; Apache ActiveMQ Artemis: from 2.0.0 through 2.44.0. Users are recommended to upgrade to version 2.53.0, which fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00429 37th percentileScored 2026-11-07

Fix Partial org.apache.artemis:artemis-openwire-protocol (Maven): 2.53.0org.apache.activemq:artemis-openwire-protocol (Maven): 2.53.0Red Hat: 1 advisoryRed Hat: 1 fixed, 10 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Apache	Apache Artemis	2.50.0 – 2.52.0	—	No fix listed	CNA
Apache	Apache ActiveMQ Artemis	2.0.0 – 2.44.0	—	No fix listed	CNA
—	org.apache.artemis:artemis-openwire-protocol (Maven)	2.50.0 to before 2.53.0	2.53.0	Patch available	GHSA-f4gc-mwrg-q36r
—	org.apache.activemq:artemis-openwire-protocol (Maven)	2.0.0 to before 2.53.0	2.53.0	Patch available	GHSA-f4gc-mwrg-q36r

Apache Artemis VendorApache Affected 2.50.0 – 2.52.0 Fixed in — No fix listed CNA
Apache ActiveMQ Artemis VendorApache Affected 2.0.0 – 2.44.0 Fixed in — No fix listed CNA
org.apache.artemis:artemis-openwire-protocol (Maven) Vendor— Affected 2.50.0 to before 2.53.0 Fixed in 2.53.0 Patch available GHSA-f4gc-mwrg-q36r
org.apache.activemq:artemis-openwire-protocol (Maven) Vendor— Affected 2.0.0 to before 2.53.0 Fixed in 2.53.0 Patch available GHSA-f4gc-mwrg-q36r

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:apache:artemis::::::::	2.0.0 – 2.44.0; 2.50.0 to before 2.53.0	Vulnerable	Apache

cpe:2.3:a:apache:artemis:*:*:*:*:*:*:*:* Versions 2.0.0 – 2.44.0; 2.50.0 to before 2.53.0 Vulnerable ·Apache

Remediation

Fix · GHSA-f4gc-mwrg-q36r org.apache.artemis:artemis-openwire-protocol (Maven) Fixed in 2.53.0 Advisory →
Fix · GHSA-f4gc-mwrg-q36r org.apache.activemq:artemis-openwire-protocol (Maven) Fixed in 2.53.0 Advisory →

Red Hat 1 advisory

RHSA-2026:8509 Released 2026-04-16 · Red Hat rating Important
Red Hat AMQ Broker 7.14.0 release and security update
- Red Hat AMQ Broker 7.14.0

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat AMQ Clients	Affected	No fix yet
Red Hat Fuse 7	Affected	No fix yet
Red Hat JBoss Enterprise Application Platform 7	Affected	No fix yet
Red Hat JBoss Enterprise Application Platform 8	Affected	No fix yet
Red Hat JBoss Enterprise Application Platform Expansion Pack	Affected	No fix yet
Red Hat Process Automation 7	Affected	No fix yet
Red Hat Satellite 6	Affected	No fix yet
Red Hat Single Sign-On 7	Affected	No fix yet
Red Hat build of Apache Camel for Spring Boot 4	Affected	No fix yet
Red Hat build of OptaPlanner 8	Affected	No fix yet
Red Hat AMQ Broker 7.14.0	Fixed	RHSA-2026:8509

Timeline

2026-10-02 Threatist record created from CVE-2026-32642
2026-10-03 Alias added: GHSA-f4gc-mwrg-q36r
2026-10-09 Fix available: RHSA-2026:8509 · Red Hat
2026-10-10 Fix available: Red Hat AMQ Broker 7.14.0 · Red Hat

References

Advisory 3

Other 1

https://github.com/apache/artemis

TI-2026-21857 Apache Artemis, Apache ActiveMQ Artemis: Auth bypass for Core downstream federation CVSS 4.0CRITICAL 9.3
TI-2023-27710 Apache ActiveMQ Artemis: Authenticated users could perform RCE via Jolokia MBeans CVSS 3.1HIGH 8.8
TI-2026-41732 Apache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session reattachment CVSS 3.1CRITICAL 9.8
TI-2026-36537 Missing authentication in Apache Artemis CVSS 3.1CRITICAL 9.1
TI-2026-47754 Missing authentication in Apache Artemis CVSS 3.1CRITICAL 9.1
TI-2021-08067 ActiveMQ: LDAP-Authentication does not verify passwords on servers with anonymous bind CVSS 3.1HIGH 7.5

See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences