Aller au contenu
en Se connecter
2.3 Faible

CVE-2026-32642 Incorrect Authorization (CWE-863) vulnerability in Apache Artemis, Apache ActiveMQ Artemis exists when an application…

Description

Incorrect Authorization (CWE-863) vulnerability in Apache Artemis, Apache ActiveMQ Artemis exists when an application using the OpenWire protocol attempts to create a non-durable JMS topic subscription on an address that doesn't exist with an authenticated user which has the "createDurableQueue" permission but does not have the "createAddress" permission and address auto-creation is disabled. In this circumstance, a temporary address will be created whereas the attempt to create the non-durable subscription should instead fail since the user is not authorized to create the corresponding address. When the OpenWire connection is closed the address is removed. This issue affects Apache Artemis: from 2.50.0 through 2.52.0; Apache ActiveMQ Artemis: from 2.0.0 through 2.44.0. Users are recommended to upgrade to version 2.53.0, which fixes the issue.

Produits et versions touchés

Produit Versions touchées Corrigé en
Apache Artemis 2.50 2.50.0 → 2.52.0 Pas de correctif indiqué
Apache ActiveMQ Artemis 2.0 2.0.0 → 2.44.0 Pas de correctif indiqué

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Apache Artemis

Les 9 CVE de Apache Artemis →
CVE-2026-49362 An unauthenticated remote attacker can create arbitrary durable queues via the CORE protocol, leading to unauthorized… Non notée CVE-2026-49363 An unauthenticated remote attacker connecting with the CORE protocol can discover cluster node details by sending a… Non notée CVE-2026-49364 An unauthenticated network-adjacent attacker can leverage discovery to capture cluster administrative credentials during… Non notée CVE-2026-57822 When the broker is processing message-based management requests, sent by an authenticated messaging client that is… Non notée
Suivre cette CVE