CVE-2026-32642
Analyzed Analyzed - Analysis Complete
Incorrect Authorization in Apache Artemis OpenWire Address Creation

Publication date: 2026-03-24

Last updated on: 2026-06-15

Assigner: Apache Software Foundation

Description
Incorrect Authorization (CWE-863) vulnerability in Apache Artemis, Apache ActiveMQ Artemis exists when an application using the OpenWire protocol attempts to create a non-durable JMS topic subscription on an address that doesn't exist with an authenticated user which has the "createDurableQueue" permission but does not have the "createAddress" permission and address auto-creation is disabled. In this circumstance, a temporary address will be created whereas the attempt to create the non-durable subscription should instead fail since the user is not authorized to create the corresponding address. When the OpenWire connection is closed the address is removed. This issue affects Apache Artemis: from 2.50.0 through 2.52.0; Apache ActiveMQ Artemis: from 2.0.0 through 2.44.0. Users are recommended to upgrade to version 2.53.0, which fixes the issue.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-24
Last Modified
2026-06-15
Generated
2026-06-16
AI Q&A
2026-03-24
EPSS Evaluated
2026-06-14
NVD
CVE-2026-32642
EUVD
EUVD-2026-14782
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
apache artemis From 2.0.0 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2026-32642 is an Incorrect Authorization vulnerability in Apache Artemis and Apache ActiveMQ Artemis when using the OpenWire protocol.

It happens when an authenticated user who has the permission to create durable queues but lacks permission to create addresses tries to create a non-durable JMS topic subscription on an address that does not exist, while address auto-creation is disabled.

Instead of denying this operation due to insufficient permissions, the system incorrectly creates a temporary address. This temporary address is removed once the OpenWire connection is closed.

Impact Analysis

This vulnerability can lead to unauthorized creation of temporary addresses in the messaging system, which should not occur without proper permissions.

While the impact is considered low severity, it may allow users to bypass intended authorization controls temporarily, potentially leading to unexpected behavior or resource usage in the messaging infrastructure.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

The recommended immediate step to mitigate this vulnerability is to upgrade Apache Artemis or Apache ActiveMQ Artemis to version 2.53.0 or later, where the issue is fixed.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-32642. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart