Description

An unauthenticated network-adjacent attacker can leverage discovery to capture cluster administrative credentials during the initial cluster connection handshake. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0. Users are recommended to upgrade to version 2.57.0, which fixes the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-09-10T05:17:01.230Z",
  "pubdate": "2026-09-10T05:17:01.230Z",
  "executiveSummary": "A critical security vulnerability exists within Apache Artemis and Apache ActiveMQ Artemis involving the insecure handling of cluster discovery operations. This vulnerability allows an unauthenticated, network-adjacent attacker to intercept and capture cluster administrative credentials during the initial handshake sequence of a cluster connection. The vulnerability stems from a flaw in the cluster discovery protocol where sensitive authentication data is transmitted without sufficient protection or mutual authentication. The primary impact is full administrative compromise of the message broker cluster, potentially leading to unauthorized message access, system configuration changes, or complete denial of service. The vulnerability affects Apache Artemis versions 2.50.0 through 2.56.0 and Apache ActiveMQ Artemis versions 1.0.0 through 2.44.0. Given that the attack requires only network adjacency and no prior authentication, the risk is considered high, necessitating immediate remediation through the implementation of security patches provided by the vendor.",
  "technicalDetails": "The vulnerability resides within the cluster discovery and connection handshake mechanism of Apache Artemis and Apache ActiveMQ Artemis. In a clustered environment, brokers utilize a discovery protocol to identify peers and negotiate cluster membership. During this initial discovery phase, the connection handshake process fails to adequately protect authentication credentials, exposing them to entities capable of monitoring network traffic within the same broadcast domain or network segment.\nThe root cause is the cleartext or insufficiently encrypted transmission of sensitive administrative credentials during the node-to-node discovery handshake. Because this phase occurs before a fully authenticated and encrypted session is established, an attacker positioned as a network-adjacent actor can utilize packet capture tools to observe the exchange. By intercepting the discovery handshake traffic, the attacker can extract the administrative credentials transmitted by the initiator.\nThe attack flow follows a predictable sequence: First, the attacker ensures they are positioned on the network segment where the broker discovery traffic is broadcast or forwarded. Second, the attacker sniffs the network interface for Artemis discovery protocol packets. Third, when a legitimate node attempts to join or reconnect to the cluster, the attacker captures the handshake packets. Finally, the attacker performs protocol analysis to isolate and decode the administrative credentials embedded within the handshake frames. Once these credentials are recovered, the attacker can use them to authenticate to the cluster management interface or the messaging service with full administrative privileges.\nThis vulnerability is particularly dangerous because it does not require an attacker to have prior knowledge of the target system's security posture or existing credentials. The exposure occurs during the automated lifecycle management of the cluster itself. The impact extends beyond simple unauthorized access, as an attacker with administrative credentials can reconfigure the message broker, intercept or modify sensitive message data, and potentially leverage the broker's underlying host to perform lateral movement within the network. The vulnerability remains present in all cluster-enabled configurations where these versions are utilized unless compensating controls or the recommended patch is applied."
}