CVE-2025-27391: Apache Artemis Information Disclosure Flaw

CVE-2025-27391 Overview

CVE-2025-27391 is an information disclosure vulnerability in Apache ActiveMQ Artemis. The flaw causes the broker to log all configuration property values, including sensitive credentials, when the org.apache.activemq.artemis.core.config.impl.ConfigurationImpl logger operates at debug level. Any user with access to broker log files can retrieve secrets that should remain confidential.

The vulnerability affects Apache ActiveMQ Artemis from version 1.5.1 through 2.39.x. Apache addressed the issue in version 2.40.0. The weakness is classified under [CWE-532] Insertion of Sensitive Information into Log File.

Critical Impact
Sensitive broker configuration values, including passwords and connection secrets, are exposed to anyone with read access to Artemis debug logs.

Affected Products

Apache ActiveMQ Artemis 1.5.1 through 2.39.x
Deployments with ConfigurationImpl logger set to debug level
Environments where log files are readable by non-administrative users

Discovery Timeline

2025-04-09 - CVE-2025-27391 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-27391

Vulnerability Analysis

Apache ActiveMQ Artemis relies on broker properties to configure runtime behavior. These properties often include credentials for downstream systems, cluster authentication secrets, and TLS keystore passwords. When operators enable debug logging on org.apache.activemq.artemis.core.config.impl.ConfigurationImpl, the broker writes every configured property value to the log stream without redaction.

Any actor able to read the resulting log files gains access to plaintext secrets. This turns a common troubleshooting configuration into a credential exposure path. The impact depends on how sensitive the broker properties are and who can access the log directory.

Attackers with local access, log aggregation privileges, or read access to shipped logs can harvest these secrets. Recovered credentials support lateral movement to connected message brokers, databases, and identity providers. The issue is limited to environments running debug-level logging on the affected component.

Root Cause

The ConfigurationImpl class emits full property maps at debug level without masking values marked as sensitive. Artemis does not apply the property-masking logic used elsewhere in the codebase to this diagnostic output path.

Attack Vector

Exploitation requires local access to Artemis log files or to any downstream log collection system. An authenticated low-privilege user with log-read permissions can retrieve credentials. No network interaction with the broker is required once debug logging is active.

No public proof-of-concept exists in Exploit-DB or vendor references. See the Apache mailing list announcement and the Openwall OSS-Security discussion for technical details.

Detection Methods for CVE-2025-27391

Indicators of Compromise

Log entries from org.apache.activemq.artemis.core.config.impl.ConfigurationImpl containing property key-value pairs
Presence of DEBUG level entries referencing broker property maps in artemis.log or equivalent
Unexpected access to Artemis log directories by non-administrative accounts

Detection Strategies

Audit Artemis logger configuration in logging.properties for debug-level assignment on ConfigurationImpl
Scan aggregated log platforms for cleartext credential patterns emitted by the affected logger
Review file access telemetry for read events against Artemis log paths by unexpected principals

Monitoring Recommendations

Alert on any change to Artemis logging configuration that raises verbosity to debug or trace
Monitor log shipping pipelines for volume spikes originating from ConfigurationImpl
Track authentication failures across systems whose credentials appear in broker configuration, which may indicate stolen secret reuse

How to Mitigate CVE-2025-27391

Immediate Actions Required

Upgrade Apache ActiveMQ Artemis to version 2.40.0 or later
Disable debug logging on org.apache.activemq.artemis.core.config.impl.ConfigurationImpl until upgrade is complete
Restrict log file and log aggregation access to administrative accounts only
Rotate any credentials that may have been written to logs while debug logging was enabled

Patch Information

Apache released the fix in ActiveMQ Artemis 2.40.0. Refer to the Apache mailing list announcement for release details. The patch prevents the ConfigurationImpl logger from emitting sensitive property values.

Workarounds

Set the ConfigurationImpl logger to INFO or higher in logging.properties
Enforce filesystem permissions that limit log directory access to the Artemis service account and trusted operators
Redirect Artemis logs to a controlled SIEM with role-based access

bash

# Example logging.properties adjustment to suppress the affected debug output
logger.org.apache.activemq.artemis.core.config.impl.ConfigurationImpl.level=INFO

# Restrict log directory permissions on Linux
chown -R artemis:artemis /var/log/artemis
chmod 750 /var/log/artemis
chmod 640 /var/log/artemis/*.log