Apache Artemis, Apache ActiveMQ Artemis: Temporary address auto-created for OpenWire consumer without createAddress permission

Vulnerability

Overview

CVE-2026-32642 is an Incorrect Authorization (CWE-863) vulnerability in Apache Artemis and Apache ActiveMQ Artemis. The issue occurs when an authenticated application using the OpenWire protocol attempts to create a non-durable JMS topic subscription on an address that does not exist. If the user has the "createDurableQueue" permission but lacks the "createAddress" permission, and address auto-creation is disabled, a temporary address is incorrectly created instead of the operation failing due to insufficient authorization [1][2].

Exploitation

Scenario

An attacker with valid credentials and the "createDurableQueue" permission can exploit this flaw by sending a crafted OpenWire request to create a non-durable subscription on a non-existent address. The broker will create a temporary address, bypassing the intended authorization check for address creation. The temporary address is automatically removed when the OpenWire connection is closed [1][2].

Impact

This vulnerability allows an authenticated user to create temporary addresses without the required "createAddress" permission, violating the security policy. While the impact is limited to temporary addresses that are cleaned up upon connection closure, it represents a breach of the authorization model and could be leveraged in more complex attack chains [1][2].

Mitigation

The issue affects Apache Artemis versions 2.50.0 through 2.52.0 and Apache ActiveMQ Artemis versions 2.0.0 through 2.44.0. Users are recommended to upgrade to version 2.53.0, which contains the fix [1][2]. No workarounds have been published.