CVE-2026-101292 vulnerability in Red Hat Products
Published on September 28, 2026

Artemis-core-client: unsafe reflection in apache activemq artemis federation message deserialization
Apache ActiveMQ Artemis before 2.34.0 contains an unsafe reflection vulnerability in FederationStreamConnectMessage.getFederationPolicy(). The method calls Class.forName(clazz).getConstructor().newInstance() where clazz is read directly from the CORE protocol wire buffer without type validation. An authenticated federation peer can send a FEDERATION_DOWNSTREAM_CONNECT packet with a crafted class name, causing the broker to load and instantiate arbitrary classes visible to the Artemis module classloader. Static initializers (<clinit>) and no-argument constructors (<init>()) execute as side effects before the type cast, enabling denial of service via system-property poisoning, out-of-memory conditions via classloading, or broker state manipulation.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-101292 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, with no impact on integrity, and a high impact on availability.

Attack Vector:

NETWORK

Attack Complexity:

LOW

Privileges Required:

NONE

User Interaction:

NONE

Scope:

UNCHANGED

Confidentiality Impact:

NONE

Integrity Impact:

LOW

Availability Impact:

HIGH

Timeline

2026-05-28

Reported to Red Hat.

2026-08-11

Made public. 75 days later.

Weakness Type

What is a Reflection Injection Vulnerability?

The application uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code. If the application uses external inputs to determine which class to instantiate or which method to invoke, then an attacker could supply values to select unexpected classes or methods. If this occurs, then the attacker could create control flow paths that were not intended by the developer. These paths could bypass authentication or access control checks, or otherwise cause the application to behave in an unexpected manner. This situation becomes a doomsday scenario if the attacker can upload files into a location that appears on the application's classpath (CWE-427) or add new entries to the application's classpath (CWE-426). Under either of these conditions, the attacker can use reflection to introduce new, malicious behavior into the application.

CVE-2026-101292 has been classified to as a Reflection Injection vulnerability or weakness.

Products Associated with CVE-2026-101292

Want to know whenever a new CVE is published for Red Hat products? stack.watch will email you.

Red Hat Jboss Enterprise Application Platform

Red Hat Jboss Enterprise Application Platform Els

Red Hat Amq Broker

Affected Versions

Red Hat JBoss Enterprise Application Platform 7.4.25: Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7:

Version 0:2.16.0-22.redhat_00057.1.el7eap and below * is unaffected.