CVE-2026-57967: Apache Artemis Auth Bypass Vulnerability

CVE-2026-57967 Overview

CVE-2026-57967 is a missing authentication vulnerability [CWE-306] in Apache ActiveMQ Artemis and Apache Artemis message brokers. An unauthenticated remote attacker can craft a CORE protocol SESSION_REATTACH packet to hijack an existing authenticated session. The attacker assumes ongoing execution of the previously authenticated session, effectively bypassing authentication controls on the broker.

The flaw affects Apache Artemis versions 2.50.0 through 2.56.0 and Apache ActiveMQ Artemis versions 1.0.0 through 2.44.0. The Apache Software Foundation released version 2.57.0 to remediate the issue.

Critical Impact
Unauthenticated network attackers can steal active broker sessions and execute operations as previously authenticated users, exposing enterprise messaging infrastructure to full compromise.

Affected Products

Apache Artemis 2.50.0 through 2.56.0
Apache ActiveMQ Artemis 1.0.0 through 2.44.0
Any application or middleware relying on the CORE wire protocol of these versions

Discovery Timeline

2026-09-10 - CVE-2026-57967 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-57967

Vulnerability Analysis

Apache ActiveMQ Artemis exposes a proprietary wire protocol referred to as the CORE protocol. Clients use this protocol to establish sessions, produce messages, and consume from queues. The protocol supports a SESSION_REATTACH packet that lets a client resume a prior session after a transient network disruption, preserving in-flight state.

The reattach handler does not authenticate the requesting connection before binding it to an existing server-side session. An attacker who can reach the broker over the network can craft a SESSION_REATTACH packet referencing an existing session identifier and take control of that session. The stolen session retains the identity, permissions, and pending operations of the original authenticated user.

The consequence is a full authentication bypass against any user with an active session on the broker. Attackers can read queued messages, publish new messages, manipulate destinations, and perform administrative actions permitted to the hijacked identity.

Root Cause

The root cause is missing authentication for a critical function [CWE-306]. The SESSION_REATTACH code path trusts session identifiers presented by the peer without validating that the peer holds the credentials or connection state associated with the original session.

Attack Vector

Exploitation requires network reachability to the Artemis CORE protocol listener, typically TCP 61616. The attacker sends a crafted SESSION_REATTACH frame containing a valid or guessable session identifier. No credentials, tokens, or user interaction are required. Once bound, the attacker issues protocol operations under the hijacked identity.

See the Apache Mailing List Thread and Openwall OSS-Security Update for the vendor advisory.

Detection Methods for CVE-2026-57967

Indicators of Compromise

Unexpected SESSION_REATTACH packets originating from IP addresses that did not previously establish an authenticated session
Broker log entries showing session continuation without a preceding authentication event
Consumer or producer activity on queues from source addresses inconsistent with the authenticated user's normal client footprint

Detection Strategies

Enable verbose CORE protocol logging on the broker and correlate session identifiers against the originating TCP connection tuple
Flag reattach operations where the client IP or TLS client certificate differs from the connection that initially authenticated the session
Alert on spikes in reattach frequency or reattach attempts referencing sessions belonging to privileged accounts

Monitoring Recommendations

Forward Artemis audit and connection logs to a centralized analytics platform for anomaly detection
Monitor TCP 61616 and any custom CORE protocol ports for connections from unauthorized network segments
Track authentication counts versus active session counts to detect session inflation caused by hijacking

How to Mitigate CVE-2026-57967

Immediate Actions Required

Upgrade Apache ActiveMQ Artemis and Apache Artemis to version 2.57.0 or later
Restrict network exposure of the CORE protocol listener to trusted application subnets using firewall or security group rules
Rotate credentials and audit queue contents for any broker that may have been exposed to untrusted networks

Patch Information

Apache recommends upgrading to Artemis 2.57.0, which corrects the SESSION_REATTACH handler to require authentication before binding to an existing session. Patch details are published in the Apache Mailing List Thread.

Workarounds

Place the Artemis broker behind a mutually authenticated TLS boundary so only clients presenting valid certificates can reach the CORE port
Disable the CORE acceptor and require alternative protocols such as AMQP or STOMP where feasible until patching is complete
Enforce network segmentation so only application servers hosting authenticated producers and consumers can reach the broker

bash

# Example: restrict Artemis CORE acceptor to localhost in broker.xml
# <acceptor name="artemis">tcp://127.0.0.1:61616?protocols=CORE;sslEnabled=true;needClientAuth=true</acceptor>
iptables -A INPUT -p tcp --dport 61616 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 61616 -j DROP