CVE-2025-27427 Overview
CVE-2025-27427 is an authorization bypass vulnerability in Apache ActiveMQ Artemis. A user holding the createDurableQueue or createNonDurableQueue permission on an address can alter the routing-type supported by that address without holding the required createAddress permission. When combined with the send permission and automatic queue creation, this flaw allows a user to deliver messages using a routing-type the address should not support. The issue affects Apache ActiveMQ Artemis versions 2.0.0 through 2.39.0 and is resolved in version 2.40.0. The weakness is categorized under [CWE-863: Incorrect Authorization].
Critical Impact
Authenticated low-privileged users can modify address routing-type configuration and deliver messages that authorization policy should reject.
Affected Products
- Apache ActiveMQ Artemis 2.0.0 through 2.39.0
- Deployments relying on granular queue permissions without createAddress
- Brokers with automatic queue creation enabled
Discovery Timeline
- 2025-04-01 - CVE-2025-27427 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-27427
Vulnerability Analysis
Apache ActiveMQ Artemis enforces distinct permissions for creating addresses, creating queues, and sending messages. The authorization model treats routing-type modification as a property of the address itself, which should require createAddress. The broker fails to enforce that separation when a queue-creation permission is exercised. A user with createDurableQueue or createNonDurableQueue can therefore expand the routing-types (ANYCAST or MULTICAST) an address supports. Combined with send and automatic queue creation, the attacker can push messages that the intended policy would otherwise reject on routing-type grounds.
Root Cause
The broker's permission-check path for augmenting an address's supported routing-types does not require the createAddress permission. This is an incorrect authorization check [CWE-863] where a lower-privileged action implicitly grants a higher-privileged capability. The check gap enables privilege escalation within the messaging authorization model without breaking authentication.
Attack Vector
Exploitation requires network access to the Artemis broker and valid credentials with limited permissions. The attacker must possess createDurableQueue or createNonDurableQueue on the target address plus send permission, and the broker must permit automatic queue creation. The attacker connects using any supported protocol (AMQP, CORE, MQTT, STOMP, OpenWire), triggers queue creation on the target address with a routing-type not previously allowed, and sends messages under the newly accepted routing-type. Refer to the Apache Mailing List Discussion and the Openwall OSS Security Update for the vendor's technical description.
Detection Methods for CVE-2025-27427
Indicators of Compromise
- Audit log entries showing routing-type changes on addresses correlated to accounts lacking createAddress permission.
- Unexpected queue creation events on addresses with mixed ANYCAST and MULTICAST routing-types.
- Messages delivered under a routing-type that policy documentation indicates should be denied.
Detection Strategies
- Enable Artemis audit logging and forward broker events to a central log platform for correlation.
- Baseline the expected routing-type per address and alert on deviations detected in broker configuration snapshots.
- Correlate authentication events with subsequent queue-creation and send activity from the same low-privilege principal.
Monitoring Recommendations
- Track invocations of queue-creation APIs on production addresses and flag unfamiliar client identifiers.
- Monitor version banners on Artemis brokers to identify hosts still running versions 2.0.0 through 2.39.0.
- Watch for spikes in automatic queue creation, which is a prerequisite condition for exploitation.
How to Mitigate CVE-2025-27427
Immediate Actions Required
- Upgrade Apache ActiveMQ Artemis to version 2.40.0, which contains the authorization fix.
- Inventory all broker instances and confirm the running version against the affected range 2.0.0 through 2.39.0.
- Review role assignments and remove createDurableQueue or createNonDurableQueue grants from users that do not require them.
Patch Information
Upgrade to Apache ActiveMQ Artemis 2.40.0. The vendor advisory is available in the Apache Mailing List Discussion. Additional coordination details appear in the Openwall OSS Security Update.
Workarounds
- Disable automatic queue creation on affected addresses by setting auto-create-queues and auto-create-addresses to false in broker.xml.
- Restrict send, createDurableQueue, and createNonDurableQueue permissions to trusted principals only.
- Segment broker network exposure so that only authenticated internal producers and consumers can reach the messaging ports.
# Configuration example: disable automatic address and queue creation in broker.xml
# <address-setting match="#">
# <auto-create-queues>false</auto-create-queues>
# <auto-create-addresses>false</auto-create-addresses>
# <auto-delete-queues>false</auto-delete-queues>
# <auto-delete-addresses>false</auto-delete-addresses>
# </address-setting>
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
