Apache Artemis/ActiveMQ Artemis CORE Protocol Durable Queue RCE 2.50.0-2.57.0
CVE-2026-49362 Published on September 10, 2026
Apache Artemis, Apache ActiveMQ Artemis: Missing Authentication in CORE Protocol Handler Allows Unauthorized Queue Creation
An unauthenticated remote attacker can create arbitrary durable queues via the CORE protocol, leading to unauthorized broker state manipulation and potential denial of service.
This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0.
Users are recommended to upgrade to version 2.57.0, which fixes the issue.
Weakness Type
Missing Authentication for Critical Function
The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Products Associated with CVE-2026-49362
Want to know whenever a new CVE is published for Apache Activemq Artemis? stack.watch will email you.
Affected Versions
Apache Software Foundation Apache Artemis:- Version 2.50.0, <= 2.56.0 is affected.
- Version 1.0.0, <= 2.44.0 is affected.