cveboard RSS feed

CVE-2026-32642

CVE.org · Published

Historical CVEsJSONAI instructions

Record status
Published
Identifier year (not publication year)
2026
Source publication
Source updated
Imported by cveboard
Source snapshot
cve_2026-10-24_midnight_baseline ·

Plain text

CNA source text (English)

Apache Artemis, Apache ActiveMQ Artemis: Temporary address auto-created for OpenWire consumer without createAddress permission

Incorrect Authorization (CWE-863) vulnerability in Apache Artemis, Apache ActiveMQ Artemis exists when an application using the OpenWire protocol attempts to create a non-durable JMS topic subscription on an address that doesn't exist with an authenticated user which has the "createDurableQueue" permission but does not have the "createAddress" permission and address auto-creation is disabled. In this circumstance, a temporary address will be created whereas the attempt to create the non-durable subscription should instead fail since the user is not authorized to create the corresponding address. When the OpenWire connection is closed the address is removed. This issue affects Apache Artemis: from 2.50.0 through 2.52.0; Apache ActiveMQ Artemis: from 2.0.0 through 2.44.0. Users are recommended to upgrade to version 2.53.0, which fixes the issue.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

Apache Artemis

Vendor
Apache Software Foundation
Product
Apache Artemis
Platforms
Unknown
Default status
unaffected
Package
org.apache.artemis:artemis-openwire-protocol
Package collection
https://repo.maven.apache.org/maven2
Apache Artemis · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
2.50.0affectedsemverUnavailable2.52.0None listed

Apache ActiveMQ Artemis

Vendor
Apache Software Foundation
Product
Apache ActiveMQ Artemis
Platforms
Unknown
Default status
unaffected
Package
org.apache.activemq:artemis-openwire-protocol
Package collection
https://repo.maven.apache.org/maven2
Apache ActiveMQ Artemis · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
2.0.0affectedsemverUnavailable2.44.0None listed