CVE-2026-32642Disclosure(apache / artemis)

LOWCVSS 4.3 · MEDIUM

Signal is active with 3 mentions in latest observed window

Immediate actions

Patch apache artemis systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Incorrect Authorization (CWE-863) vulnerability in Apache Artemis, Apache ActiveMQ Artemis exists when an application using the OpenWire protocol attempts to create a non-durable JMS topic subscription on an address that doesn't exist with an authenticated user which has the "createDurableQueue" permission but does not have the "createAddress" permission and address auto-creation is disabled. In this circumstance, a temporary address will be created whereas the attempt to create the non-durable subscription should instead fail since the user is not authorized to create the corresponding address. When the OpenWire connection is closed the address is removed. This issue affects Apache Artemis: from 2.50.0 through 2.52.0; Apache ActiveMQ Artemis: from 2.0.0 through 2.44.0. Users are recommended to upgrade to version 2.53.0, which fixes the issue.

apache CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

Weakness type (CWE)

CWE-863

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

artemis

Threat summary

Patch or workaround signal is available
4 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 4 signals
Disclosure: 2 classified signals
General: 1 classified signal
Peaked at 3 mentions on most recent observed day (2026-03-24)
4 total mentions across 2 days

Affected systems

Vendors

apache

Products

artemis

Deep dive

Activity timeline4 mentions / 2d

Signal classification3 categories

Disclosure

250.0%

General

125.0%

Patch

125.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-21	1	General1
2026-03-24	3	Disclosure2Patch1

Full discourse4 posts

Open Source Security mailing list@oss_security202d
General
CVE-2026-32642: Apache Artemis, Apache ActiveMQ Artemis: Temporary address auto-created for OpenWire consumer without createAddress permission https://www.openwall.com/lists/oss-security/2026/03/20/2 whereas the attempt to create the non-durable subscription should instead fail since the user is not authorized
Post summary
The post notes a privilege‑bypass flaw in Apache Artemis that allows automatic creation of temporary addresses, but provides no PoC, exploit code, active‑exploitation evidence, or patch details.
01061477
4.4K followersView on X
Fernando Karl@fernandokarl198d
Patch
⚠️ Atenção, profissionais de #cybersegurança! Uma falha no Apache Artemis permite a criação não autorizada de endereços temporários via OpenWire. 🛡️ Atualize para a versão 2.53.0 e revise suas permissões para evitar abusos! Saiba mais: https://www.tenable.com/cve/CVE-2026-32642 #Apache #Segurança
Post summary
The post alerts users to CVE-2026-32642 in Apache Artemis, recommending an upgrade to 2.53.0 and permission adjustments, with no proof‑of‑concept, exploit code, or active exploitation discussed.
0000027
258 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds198d
Disclosure
CVE-2026-32642 Incorrect Authorization in Apache ActiveMQ Artemis 2.0.0–2.44.0 and Artemis 2.50.0–2.52.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-32642
Post summary
The content announces CVE-2026-32642 as an incorrect authorization flaw affecting specific Apache ActiveMQ Artemis versions, with a reference link to Vulmon, but contains no exploitation details, PoC, or patch information.
0000036
4.0K followersView on X
CVE@CVEnew198d
Disclosure
CVE-2026-32642 Incorrect Authorization (CWE-863) vulnerability in Apache Artemis, Apache ActiveMQ Artemis exists when an application using the OpenWire protocol attempts to create a… https://www.cve.org/CVERecord?id=CVE-2026-32642
Post summary
The post cites an Incorrect Authorization (CWE‑863) vulnerability in Apache Artemis/ActiveMQ Artemis that triggers when using the OpenWire protocol, but provides no crisis or mitigation details.
0000051
56.8K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	apache	artemis	-	-	-

Explore more

Back to dashboard apache CVEs artemis vulnerabilities

What researchers are saying

CVE-2026-32642

Open Source Security mailing list@oss_securityGeneral

The post notes a privilege‑bypass flaw in Apache Artemis that allows automatic creation of temporary addresses, but provides no PoC, exploit code, active‑exploitation evidence, or patch details.

Fernando Karl@fernandokarlPatch

The post alerts users to CVE-2026-32642 in Apache Artemis, recommending an upgrade to 2.53.0 and permission adjustments, with no proof‑of‑concept, exploit code, or active exploitation discussed.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The content announces CVE-2026-32642 as an incorrect authorization flaw affecting specific Apache ActiveMQ Artemis versions, with a reference link to Vulmon, but contains no exploitation details, PoC, or patch information.

CVE@CVEnewDisclosure

The post cites an Incorrect Authorization (CWE‑863) vulnerability in Apache Artemis/ActiveMQ Artemis that triggers when using the OpenWire protocol, but provides no crisis or mitigation details.