Technical impact
An incorrect authorization flaw allows an authenticated user who has permission to create durable queues to circumvent the absence of createAddress rights when attempting to create a temporary JMS topic subscription via the OpenWire protocol. The result is that a temporary address is created automatically, thereby permitting the user to subscribe to (and potentially read from) a resource they should not be able to access. This unauthorized creation violates the intended access controls and may expose sensitive messaging data.
Affected Systems
Apache Software Foundation products Apache Artemis and Apache ActiveMQ Artemis are affected. Vulnerable releases span Apache Artemis 2.50.0 through 2.52.0 and Apache ActiveMQ Artemis 2.0.0 through 2.44.0. All editions of these products deployed in environments where OpenWire connections are enabled fall under the scope.
Risk and Exploitability
The CVSS score of 2.3 indicates low severity, and the EPSS score of less than 1 percent suggests a low probability of exploitation. The vulnerability is not included in CISA’s Known Exploited Vulnerabilities list. Exploitation would require an authenticated OpenWire client with createDurableQueue privileges but lacking createAddress rights. The condition that address auto‑creation is disabled is already met in the affected configuration. While the attack surface is narrow, the potential for unauthorized access to message topics warrants timely remediation.
Github GHSA