CVE-2026-57967: Apache ActiveMQ Artemis Session Hijack via CORE Protocol

Overview

CVE-2026-57967 is a critical session-hijacking vulnerability in Apache ActiveMQ Artemis that lets an unauthenticated remote attacker take over an existing, already-authenticated client session. By crafting a CORE protocol SESSION_REATTACH packet, an attacker can reconnect to and assume control of a session that another user previously established — inheriting whatever privileges and in-progress work that session held.

Technical Details

How It Works

Artemis's CORE protocol supports session reattachment (SESSION_REATTACH) so that clients can resume a broker session after a transient network interruption, without forcing a full re-authentication. The vulnerable versions did not properly verify that the party issuing the reattach request was the legitimate owner of the session being resumed.

An attacker who can send a crafted SESSION_REATTACH packet to the broker can therefore hijack an existing session belonging to another, already-authenticated client — assuming its identity and continuing its ongoing execution context without ever presenting valid credentials.

Impact Assessment

Who Is At Risk

• Any Artemis broker reachable over the network by clients whose sessions could be targeted for reattachment
• Deployments where sessions carry elevated privileges (administrative consoles, privileged producer/consumer roles)
• Environments without strict network segmentation between broker clients and untrusted network segments

Potential Attack Chains

1. Session Identification — Attacker identifies or brute-forces session identifiers eligible for reattachment.
2. Unauthenticated Reattach — Attacker sends a crafted SESSION_REATTACH CORE packet, hijacking the target session.
3. Privilege Inheritance — The hijacked session retains whatever queue access and permissions the original authenticated client held.
4. Message Manipulation — Attacker can read, inject, or redirect messages within the scope of the stolen session.

Mitigation

Immediate Actions

• Upgrade to Apache Artemis 2.57.0, which fixes the reattachment authentication gap.
• Restrict broker network exposure — limit CORE protocol ports to trusted client networks only.
• Review active session logs post-upgrade for any signs of prior unexpected reattachment activity.

Detection Opportunities

• Monitor broker logs for SESSION_REATTACH requests originating from IP addresses that differ from the session's original client.
• Alert on reattachment attempts against sessions that were not recently disconnected.
• Watch for anomalous message patterns (unexpected consumers/producers) appearing mid-session.

Defence-in-Depth

• Apply TLS with mutual authentication for all broker client connections to reduce the exposure window for session-level attacks.
• Set conservative session timeout and reattachment windows to shrink the opportunity for hijacking.
• Segment high-privilege broker clients (administrative tooling) onto isolated network paths.

Background

CVE-2026-57967 was disclosed alongside CVE-2026-49364 (cluster credential exposure) and CVE-2026-67593 (unauthenticated queue deletion) as part of the same Apache Artemis security batch, all resolved in version 2.57.0. Given the CVSS 9.8 score and zero authentication requirement, this is the most severe of the three and should be prioritized for immediate patching.

References

• NVD — CVE-2026-57967
• Apache Artemis Security Advisories