Plataforma
java
Componente
apache-artemis
Corregido en
1.17.4
1.16.3
1.15.2
CVE-2026-4649 describes an authentication bypass vulnerability affecting Apache Artemis versions prior to 2.52.0. This flaw allows an attacker with sufficient privileges to read all messages exchanged through the broker and inject new messages. KNIME Business Hub, which utilizes Apache Artemis, is also affected, particularly for users who can execute workflows within an executor.
The impact of CVE-2026-4649 is significant due to the potential for unauthorized access to sensitive data and manipulation of message queues. An attacker who can exploit this vulnerability can read all messages passing through the Apache Artemis broker, potentially exposing confidential information like user credentials, financial data, or proprietary business logic. Furthermore, the ability to inject new messages allows an attacker to disrupt operations, inject malicious commands, or even gain further access to the underlying system. This vulnerability is particularly concerning within KNIME Business Hub environments where workflows and data processing pipelines rely on Apache Artemis for message routing.
CVE-2026-4649 is related to CVE-2026-27446, both impacting Apache Artemis. Public proof-of-concept (PoC) code is currently unavailable, but the vulnerability's nature suggests a relatively low barrier to exploitation. The vulnerability was publicly disclosed on 2026-03-24. The EPSS score is pending evaluation, but the potential for data exfiltration and system disruption warrants careful attention.
Organizations utilizing KNIME Business Hub with Apache Artemis integration are at risk, particularly those with users possessing executor privileges. Legacy KNIME deployments using older Apache Artemis versions are especially vulnerable. Shared hosting environments where multiple users share access to the Apache Artemis broker also face increased risk.
• linux / server:
journalctl -u apache-artemis -g "authentication bypass"• java / server:
Monitor Apache Artemis logs for unusual connection attempts or unauthorized message activity. Look for patterns indicative of message injection.
• generic web:
Check Apache Artemis configuration files for insecure settings or exposed endpoints. Use curl to probe for potential vulnerabilities.
disclosure
Estado del Exploit
EPSS
0.05% (14% percentil)
CISA SSVC
The primary mitigation for CVE-2026-4649 is to upgrade Apache Artemis to version 1.17.4 or later. If upgrading is not immediately feasible, restrict access to the Apache Artemis broker to only authorized users and processes. Implement strict access controls within KNIME Business Hub to limit the ability of users to execute workflows in executors. Consider implementing a Web Application Firewall (WAF) to filter potentially malicious requests targeting the broker. After upgrading, verify the fix by attempting to connect to the Apache Artemis broker with unauthorized credentials and confirming that access is denied.
Actualice KNIME Business Hub a la versión 1.18.0, 1.17.4 o 1.16.3, que incluyen una versión corregida de Apache Artemis. Esto solucionará la vulnerabilidad de omisión de autenticación y evitará el acceso no autorizado a los mensajes internos.
Análisis de vulnerabilidades y alertas críticas directamente en tu correo.
CVE-2026-4649 is an authentication bypass vulnerability in Apache Artemis versions 0.0.0–1.17.4, allowing unauthorized message reading and injection. It affects KNIME Business Hub users with executor access.
You are affected if you are using Apache Artemis versions 0.0.0 through 1.17.4, or KNIME Business Hub that utilizes Apache Artemis and has users with executor privileges.
Upgrade Apache Artemis to version 1.17.4 or later. Restrict access to the broker and limit executor privileges in KNIME Business Hub as an interim measure.
While no active exploitation has been confirmed, the vulnerability's nature suggests a low barrier to exploitation, and it warrants immediate attention.
Refer to the Apache Artemis security page for updates and advisories: https://active.apache.org/
Sube tu archivo de dependencias y detecta esta y otras CVEs al instante.
Sube tu archivo pom.xml y te decimos al instante si estás afectado.