CVE-2026-101292

LOWCVSS 8.2 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Apache ActiveMQ Artemis before 2.34.0 contains an unsafe reflection vulnerability in FederationStreamConnectMessage.getFederationPolicy(). The method calls Class.forName(clazz).getConstructor().newInstance() where clazz is read directly from the CORE protocol wire buffer without type validation. An authenticated federation peer can send a FEDERATION_DOWNSTREAM_CONNECT packet with a crafted class name, causing the broker to load and instantiate arbitrary classes visible to the Artemis module classloader. Static initializers (<clinit>) and no-argument constructors (<init>()) execute as side effects before the type cast, enabling denial of service via system-property poisoning, out-of-memory conditions via classloading, or broker state manipulation.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-470

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

1 mentions across 1 observed day

What's happening

1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Full discourse1 post

Hossted@Hossted_OSS1d
5 vulnerabilities that kept security teams busy in October. In October 2026, five foundational infrastructure tools got hit with vulnerabilities that standard monitoring would not have caught: 🔴 #Kubernetes (CVE-2026-92574): security context bypass allowed users with pod creation privileges to break out of container boundaries. 🔴 #Redis (CVE-2026-92925): improper input validation in the cluster bus packet parser enabled remote denial of service and potential code execution. 🔴 #ApacheActiveMQ (CVE-2026-101292): unsafe reflection flaw allowed unauthenticated remote attackers to execute arbitrary shell commands. 🔴 #ApacheAirflow (CVE-2026-82310): token validation failure allowed deactivated accounts to retain indefinite access to pipelines. 🔴 #ApacheZooKeeper (CVE-2026-59969): TLS hostname verification bypass left cluster traffic vulnerable to man-in-the-middle attacks. A green status indicator means the service is running. It does not mean it is secure. 👇 CVE breakdown and patch details in the first comment. #DevOps #DevSecOps #Kubernetes #CyberSecurity #AppSec #OpenSource #Hossted
1000032
218 followersView on X

Explore more

Back to dashboard