Improper access control in Artemis and ActiveMQ Artemis - CVE-2026-40914
Published: June 4, 2026
Vulnerability identifier: #VU133401
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2026-40914
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Apache Foundation
Affected software:
Artemis
ActiveMQ Artemis
Artemis
ActiveMQ Artemis
Detailed vulnerability description
The vulnerability allows a remote user to bypass authorization checks on address routing-type restrictions.
The vulnerability exists due to improper access control in the STOMP protocol address handling when processing STOMP operations on an address with send or consume permissions but without createAddress permission. A remote user can send crafted STOMP operations to augment the routing-type supported by an address to bypass authorization checks on address routing-type restrictions.
This can allow message send or consume operations to succeed with a routing-type not supported by the corresponding address when those operations should be rejected.
How to mitigate CVE-2026-40914
Install security update from vendor's website.