CVE-2026-32642: 
Java vulnerability analysis and mitigation

CVE-2026-32642 is an Incorrect Authorization vulnerability (CWE-863) in Apache Artemis and Apache ActiveMQ Artemis that allows an authenticated user with limited permissions to bypass address creation controls via the OpenWire protocol. When a user possessing the createDurableQueue permission (but lacking createAddress permission) attempts to create a non-durable JMS topic subscription on a non-existent address with auto-creation disabled, a temporary address is incorrectly created instead of the operation failing. The temporary address is removed when the OpenWire connection closes. Affected versions are Apache Artemis 2.50.0 through 2.52.0 and Apache ActiveMQ Artemis 2.0.0 through 2.44.0. It carries a CVSS v3.1 base score of 4.3 (Medium) and a CVSS v4.0 base score of 2.3 (Low) (Red Hat Advisory, OSS-Security).

The root cause is an Incorrect Authorization flaw (CWE-863) in the OpenWire protocol handler of Apache Artemis and ActiveMQ Artemis. When address auto-creation is disabled and a user with createDurableQueue but not createAddress permission attempts to subscribe to a non-existent JMS topic, the broker incorrectly creates a temporary address rather than rejecting the request. The vulnerability is network-accessible, requires low privileges (a valid authenticated account), and has low attack complexity, but requires the specific precondition that address auto-creation is disabled in the broker configuration. No public proof-of-concept exploit code has been identified (OSS-Security, Red Hat Bugzilla).

Exploitation allows an authenticated user with restricted permissions to create unauthorized temporary addresses on the broker, circumventing the intended authorization policy that should prevent address creation when auto-creation is disabled. The impact is limited to a low integrity effect — no confidentiality or availability impact is present — and the unauthorized address is automatically removed upon connection closure. There is no evidence of lateral movement potential or sensitive data exposure associated with this vulnerability (Red Hat Advisory, OSS-Security).

1. Identify a vulnerable target: Locate an Apache Artemis (2.50.0–2.52.0) or Apache ActiveMQ Artemis (2.0.0–2.44.0) broker with address auto-creation disabled in its configuration.
2. Obtain low-privilege credentials: Acquire or use an authenticated account that has the createDurableQueue permission but explicitly lacks the createAddress permission.
3. Establish an OpenWire connection: Connect to the broker using the OpenWire protocol (e.g., via a JMS client or ActiveMQ client library).
4. Attempt non-durable topic subscription: Send a request to create a non-durable JMS topic subscription on an address that does not yet exist on the broker.
5. Observe unauthorized address creation: The broker incorrectly creates a temporary address instead of rejecting the request, bypassing the intended authorization check.
6. Address removed on disconnect: When the OpenWire connection is closed, the temporary address is automatically removed (OSS-Security, Red Hat Bugzilla).

• Logs: Broker logs showing unexpected address creation events for addresses not provisioned by administrators, particularly associated with OpenWire protocol connections from accounts with limited permissions.
• Broker State: Transient addresses appearing and disappearing in the broker's address list that correspond to JMS topic names not defined in the broker configuration, correlated with OpenWire client connect/disconnect events.
• Network: OpenWire protocol connections (default port 61616) from clients attempting subscriptions to non-existent topic addresses, especially from accounts that should not have address creation rights.

Users should upgrade to Apache Artemis 2.53.0 or later, which resolves the issue. For Apache ActiveMQ Artemis, upgrade to a version beyond 2.44.0. Red Hat has addressed this in Red Hat AMQ Broker 7.14.0 via errata RHSA-2026:8509. As an interim workaround, restrict network access to the OpenWire protocol endpoint (default port 61616) to trusted systems only, and enforce the principle of least privilege by reviewing and tightening user permission assignments for address and queue creation (Red Hat Bugzilla, Red Hat Errata, OSS-Security).

The vulnerability was reported by Stephen Higgs and disclosed by Apache committer Justin Bertram via the oss-security mailing list on March 20, 2026. Red Hat tracked the issue via Bugzilla and addressed it in Red Hat AMQ Broker 7.14.0. Community reaction has been minimal given the low severity rating and absence of public exploitation (OSS-Security, Red Hat Bugzilla).