Skip to content
Fencer Vulns
medium 4.3

CVE-2026-32642 json

Apache Artemis, Apache ActiveMQ Artemis: Temporary address auto-created for OpenWire consumer without createAddress permission

published 2026-03-24 7 mo ago modified 2026-06-17 4 mo ago also EUVD-2026-14782 , GHSA-f4gc-mwrg-q36r

cvss
4.3
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 37%
public exploits
0
none known

Summary

Incorrect Authorization (CWE-863) vulnerability in Apache Artemis, Apache ActiveMQ Artemis exists when an application using the OpenWire protocol attempts to create a non-durable JMS topic subscription on an address that doesn't exist with an authenticated user which has the "createDurableQueue" permission but does not have the "createAddress" permission and address auto-creation is disabled. In this circumstance, a temporary address will be created whereas the attempt to create the non-durable subscription should instead fail since the user is not authorized to create the corresponding address. When the OpenWire connection is closed the address is removed.

This issue affects Apache Artemis: from 2.50.0 through 2.52.0; Apache ActiveMQ Artemis: from 2.0.0 through 2.44.0.

Users are recommended to upgrade to version 2.53.0, which fixes the issue.

Patch / fix

  • maven org.apache.artemis:artemis-openwire-protocol 2.53.0
  • maven org.apache.activemq:artemis-openwire-protocol 2.53.0
  • apache artemis 2.53.0
  • org.apache.artemis artemis-openwire-protocol 2.53.0
  • org.apache.activemq artemis-openwire-protocol 2.53.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-32642 updated cvss 4.3

Apache Artemis: Apache ActiveMQ Artemis: Apache Artemis and Apache ActiveMQ Artemis: Unauthorized address creation due to incorrect authorization during JMS topic subscription.

  • Red Hat AMQ Clients artemis-server Red Hat build of Apache Camel for Spring Boot 4 artemis-server Red Hat build of OptaPlanner 8 artemis-server Red Hat Fuse 7 artemis-server Red Hat JBoss Enterprise Application Platform 7 artemis-server Red Hat JBoss Enterprise Application Platform 8 artemis-server
    +4 more products
    Red Hat JBoss Enterprise Application Platform Expansion Pack artemis-server Red Hat Process Automation 7 artemis-server Red Hat Satellite 6 candlepin, candlepin-selinux Red Hat Single Sign-On 7 artemis-server
    affected: no fix available
  • Red Hat AMQ Broker 7.14.0
    fixed: vendor fix RHSA-2026:8509

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
7 mo ago

Exploit prediction

0.43% chance of exploitation in the next 30 days, higher than 37% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 2.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CNA 4.0 2.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD 3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Affected packages

ecosystem package affected fixed in
maven org.apache.artemis:artemis-openwire-protocol
>=2.50.0, <2.53.0
2.53.0
maven org.apache.activemq:artemis-openwire-protocol
>=2.0.0, <2.53.0
2.53.0

Affected products

  • Apache Software Foundation Apache Artemis
  • Apache Software Foundation Apache ActiveMQ Artemis

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.