Auth bypass in Apache Software Foundation Activemq Artemis

CVE-2026-32642

Incorrect Authorization (CWE-863) vulnerability in Apache Artemis, Apache ActiveMQ Artemis exists when an application using the OpenWire protocol attempts to create a non-durable JMS topic subscription on an address that doesn't exist with…

Vulnerability class: Broken Access Control

EPSS: 0.000 (8.9th percentile) — read the EPSS interpretation.

Affected products

Apache Software Foundation Activemq Artemis — versions 2.0.0
Apache Software Foundation Artemis — versions 2.50.0

Weakness classification (CWE)

CWE-863 — Incorrect Authorization

References

lists.apache.org/thread/4wlrp31ngq2yb54sf4kjb3bl41t4xgtp (vendor-advisory)