CVE-2026-49364 Overview
CVE-2026-49364 affects Apache ActiveMQ Artemis and Apache Artemis message brokers. An unauthenticated network-adjacent attacker can leverage the discovery mechanism to capture cluster administrative credentials during the initial cluster connection handshake. The flaw is classified as Missing Authentication for Critical Function [CWE-306]. Successful exploitation exposes cluster admin credentials, enabling further compromise of the messaging infrastructure and any services that trust it.
Critical Impact
Attackers on an adjacent network segment can intercept cluster administrative credentials during broker discovery, leading to full control of the Artemis cluster.
Affected Products
- Apache Artemis versions 2.50.0 through 2.56.0
- Apache ActiveMQ Artemis versions 1.0.0 through 2.44.0
- Fixed in Apache ActiveMQ Artemis version 2.57.0
Discovery Timeline
- 2026-09-10 - CVE-2026-49364 published to the National Vulnerability Database
- 2026-09-10 - Last updated in NVD database
Technical Details for CVE-2026-49364
Vulnerability Analysis
Apache ActiveMQ Artemis supports clustering, where broker nodes discover peers and establish trust to form a distributed message broker. The initial cluster connection handshake transmits administrative credentials used to authorize inter-node operations. The vulnerability arises because the discovery and handshake flow does not adequately protect these credentials against interception by unauthenticated parties on the same broadcast domain or reachable network segment.
An attacker capable of receiving or eliciting discovery traffic can capture the credentials exchanged during this handshake. Once obtained, the credentials grant cluster-level administrative rights, allowing the attacker to publish or consume messages, reconfigure queues, and pivot into any downstream system that consumes broker events.
Root Cause
The root cause is missing authentication and protection on a critical function [CWE-306]. The cluster discovery and handshake path exposes administrative credentials to a network-adjacent observer without requiring a mutually authenticated, confidential channel prior to credential transfer.
Attack Vector
Exploitation requires network adjacency to the broker's cluster discovery traffic, typically a shared multicast group or reachable JGroups or UDP discovery endpoint. No authentication is needed. The attacker passively or actively participates in discovery, then records the handshake in which cluster admin credentials are transmitted. See the Apache Mailing List Discussion and OpenWall OSS Security Update for coordinating vendor detail.
No verified public exploit code is available at the time of publication. Refer to the vendor references for technical detail on the handshake sequence.
Detection Methods for CVE-2026-49364
Indicators of Compromise
- Unexpected hosts joining or probing the Artemis cluster discovery group (multicast or JGroups endpoints).
- Cluster handshake attempts originating from IP addresses outside the documented broker node inventory.
- Broker log entries showing successful cluster authentication from unknown node identifiers or unusual client software.
- Sudden configuration changes, queue creations, or message flows initiated using the cluster admin account.
Detection Strategies
- Baseline the set of legitimate broker nodes and alert on any new participant in cluster discovery traffic.
- Inspect network flows for unauthorized subscribers to the Artemis multicast group or discovery ports.
- Correlate Artemis audit.log entries for cluster admin actions with the source IP of the connecting node.
Monitoring Recommendations
- Forward Artemis broker and audit logs to a centralized analytics platform for continuous review.
- Monitor east-west traffic on segments hosting Artemis brokers for anomalous UDP or JGroups activity.
- Alert on process behavior indicating credential harvesting tools running on hosts adjacent to broker subnets.
How to Mitigate CVE-2026-49364
Immediate Actions Required
- Upgrade all Apache ActiveMQ Artemis and Apache Artemis brokers to version 2.57.0.
- Rotate cluster administrative credentials after upgrade, assuming prior exposure.
- Restrict cluster discovery traffic to a dedicated, isolated management VLAN accessible only to broker nodes.
Patch Information
Apache has released Apache ActiveMQ Artemis version 2.57.0, which remediates the credential exposure in the cluster handshake. Administrators should validate the upgrade in a staging environment, then roll it out cluster-wide following the vendor upgrade guidance referenced in the Apache Mailing List Discussion.
Workarounds
- Place broker cluster interfaces on an isolated network segment unreachable from user or application zones.
- Enforce TLS on all cluster connectors and acceptors to protect handshake traffic in transit.
- Replace multicast-based discovery with a static cluster connection list restricted to known broker addresses.
- Apply strict firewall rules limiting discovery and cluster ports to authorized broker IP addresses only.
# Configuration example
# Refer to vendor documentation for full syntax; upgrade to 2.57.0 remains the primary remediation.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
