Platform
java
Component
apache-artemis
Fixed in
1.17.4
1.16.3
1.15.2
CVE-2026-4649 describes an authentication bypass vulnerability affecting Apache Artemis versions prior to 2.52.0. This flaw allows an attacker with sufficient privileges to read all messages exchanged through the broker and inject new messages. KNIME Business Hub, which utilizes Apache Artemis, is also affected, particularly for users who can execute workflows within an executor.
The impact of CVE-2026-4649 is significant due to the potential for unauthorized access to sensitive data and manipulation of message queues. An attacker who can exploit this vulnerability can read all messages passing through the Apache Artemis broker, potentially exposing confidential information like user credentials, financial data, or proprietary business logic. Furthermore, the ability to inject new messages allows an attacker to disrupt operations, inject malicious commands, or even gain further access to the underlying system. This vulnerability is particularly concerning within KNIME Business Hub environments where workflows and data processing pipelines rely on Apache Artemis for message routing.
CVE-2026-4649 is related to CVE-2026-27446, both impacting Apache Artemis. Public proof-of-concept (PoC) code is currently unavailable, but the vulnerability's nature suggests a relatively low barrier to exploitation. The vulnerability was publicly disclosed on 2026-03-24. The EPSS score is pending evaluation, but the potential for data exfiltration and system disruption warrants careful attention.
Exploit Status
EPSS
0.05% (14% percentile)
CISA SSVC
The primary mitigation for CVE-2026-4649 is to upgrade Apache Artemis to version 1.17.4 or later. If upgrading is not immediately feasible, restrict access to the Apache Artemis broker to only authorized users and processes. Implement strict access controls within KNIME Business Hub to limit the ability of users to execute workflows in executors. Consider implementing a Web Application Firewall (WAF) to filter potentially malicious requests targeting the broker. After upgrading, verify the fix by attempting to connect to the Apache Artemis broker with unauthorized credentials and confirming that access is denied.
Update KNIME Business Hub to version 1.18.0, 1.17.4, or 1.16.3, which include a fixed version of Apache Artemis. This will resolve the authentication bypass vulnerability and prevent unauthorized access to internal messages.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2026-4649 is an authentication bypass vulnerability in Apache Artemis versions 0.0.0–1.17.4, allowing unauthorized message reading and injection. It affects KNIME Business Hub users with executor access.
You are affected if you are using Apache Artemis versions 0.0.0 through 1.17.4, or KNIME Business Hub that utilizes Apache Artemis and has users with executor privileges.
Upgrade Apache Artemis to version 1.17.4 or later. Restrict access to the broker and limit executor privileges in KNIME Business Hub as an interim measure.
While no active exploitation has been confirmed, the vulnerability's nature suggests a low barrier to exploitation, and it warrants immediate attention.
Refer to the Apache Artemis security page for updates and advisories: https://active.apache.org/
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your pom.xml file and we'll tell you instantly if you're affected.