CVE-2026-40914

Name of the Vulnerable Software and Affected Versions Apache Artemis versions 2.50.0 through 2.53.0 Apache ActiveMQ Artemis versions 2.0.0 through 2.44.0

Description An issue exists where an application using the STOMP (Simple Text Oriented Messaging Protocol) protocol can augment the routing-type of an address. This occurs when security credentials grant either consume or send permissions on an address, allowing the user to perform these operations with a routing-type not supported by the address, even without the createAddress permission. Normally, such operations should be rejected if the user lacks the permission to change the routing-type.

Recommendations Upgrade Apache Artemis to version 2.54.0. Upgrade Apache ActiveMQ Artemis to version 2.54.0.