CVE-2026-49364: Apache ActiveMQ Artemis Cluster Credential Exposure

Overview

Apache has disclosed CVE-2026-49364, a critical vulnerability in ActiveMQ Artemis that allows an unauthenticated, network-adjacent attacker to capture cluster administrative credentials during the initial cluster connection handshake. The flaw affects broker clustering — the mechanism Artemis nodes use to discover and authenticate to one another — rather than client-facing messaging traffic.

Because cluster discovery and connection setup occur before full authentication and authorization is enforced, an attacker positioned to observe or interact with this handshake can obtain credentials that grant administrative control over the broker cluster.

Technical Details

How It Works

Artemis brokers configured for clustering exchange discovery and connection information so nodes can locate and join the cluster automatically. During this initial handshake, cluster administrative credentials are exposed to any party able to observe or participate in the exchange — before the connection has completed authentication and authorization.

An unauthenticated attacker with network access to the cluster discovery channel can leverage this to capture those credentials and subsequently authenticate as a privileged cluster administrator, gaining control over broker configuration, queues, and connected clients.

Impact Assessment

Who Is At Risk

• Organizations running clustered Artemis deployments with discovery traffic reachable from untrusted or insufficiently segmented network zones
• Multi-tenant messaging infrastructure where cluster nodes span different trust boundaries
• Any deployment still on Artemis 2.50.0–2.56.0 or legacy ActiveMQ Artemis 1.0.0–2.44.0

Potential Attack Chains

1. Credential Capture — Attacker observes or interacts with the cluster handshake and extracts administrative credentials.
2. Cluster Takeover — Captured credentials are used to authenticate as a cluster admin.
3. Message Interception & Manipulation — Administrative access allows reading, redirecting, or destroying messages flowing through the broker.
4. Downstream Compromise — Applications relying on the broker for critical workflows (order processing, event pipelines, service communication) can be disrupted or manipulated.

Mitigation

Immediate Actions

• Upgrade to Apache Artemis 2.57.0, which addresses the credential exposure in the cluster handshake.
• Restrict cluster discovery traffic to trusted, segmented internal networks — never expose cluster ports to the public internet or untrusted VLANs.
• Rotate cluster administrative credentials after upgrading, in case they were previously exposed.

Detection Opportunities

• Review network flow logs for unexpected connections to Artemis cluster discovery ports from outside the expected node set.
• Audit broker logs for cluster join attempts from unrecognized hosts.
• Monitor for administrative actions performed by cluster credentials outside of normal maintenance windows.

Defence-in-Depth

• Enforce network segmentation and firewalling around all broker cluster traffic.
• Apply mutual TLS between cluster nodes where supported, rather than relying solely on credential-based trust.
• Maintain a regular patch cadence for messaging middleware given its role as shared, high-trust infrastructure.

Background

This disclosure is part of a broader batch of Apache Artemis vulnerabilities patched in version 2.57.0, alongside CVE-2026-57967 (session hijack) and CVE-2026-67593 (unauthenticated queue deletion), both also covered on CosmicBytez Labs. Organizations running Artemis should treat 2.57.0 as a priority upgrade rather than patching each CVE individually.

References

• NVD — CVE-2026-49364
• Apache Artemis Security Advisories