Main Vulnerability Database Vulnerabilities #VU133401

Improper access control in Artemis and ActiveMQ Artemis - CVE-2026-40914

Published: June 4, 2026

Vulnerability identifier: #VU133401

CSH Severity: Low

CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-40914

CWE-ID: CWE-284

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote user to bypass authorization checks on address routing-type restrictions.

The vulnerability exists due to improper access control in the STOMP protocol address handling when processing STOMP operations on an address with send or consume permissions but without createAddress permission. A remote user can send crafted STOMP operations to augment the routing-type supported by an address to bypass authorization checks on address routing-type restrictions.

This can allow message send or consume operations to succeed with a routing-type not supported by the corresponding address when those operations should be rejected.

Affected software

Artemis
ActiveMQ Artemis

How to mitigate CVE-2026-40914

Install security update from vendor's website.

Artemis - update to 2.54.0

External References

Related Security Bulletins