CVE-2026-49364
Apache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-Authentication Cluster Credential Exposure to Discovered Peers
CVSS Score
9.1
EPSS Score
0.0%
EPSS Percentile
0th
An unauthenticated network-adjacent attacker can leverage discovery to capture cluster administrative credentials during the initial cluster connection handshake. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0. Users are recommended to upgrade to version 2.57.0, which fixes the issue.
| CWE | CWE-306 |
| Vendor | apache software foundation |
| Product | apache artemis |
| Published | Sep 10, 2026 |
| Last Updated | Sep 10, 2026 |
Stay Ahead of the Next One
Get instant alerts for apache software foundation apache artemis
Be the first to know when new critical vulnerabilities affecting apache software foundation apache artemis are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Apache Software Foundation / Apache Artemis
2.50.0 ≤ 2.56.0
Apache Software Foundation / Apache Artemis
2.50.0 ≤ 2.56.0
Apache Software Foundation / Apache ActiveMQ Artemis
1.0.0 ≤ 2.44.0
Apache Software Foundation / Apache ActiveMQ Artemis
1.0.0 ≤ 2.44.0
References
Credits
Domenico Francesco Bruscino