Plateforme
java
Composant
apache-artemis
Corrigé dans
1.17.4
1.16.3
1.15.2
CVE-2026-4649 describes an authentication bypass vulnerability affecting Apache Artemis versions prior to 2.52.0. This flaw allows an attacker with sufficient privileges to read all messages exchanged through the broker and inject new messages. KNIME Business Hub, which utilizes Apache Artemis, is also affected, particularly for users who can execute workflows within an executor.
The impact of CVE-2026-4649 is significant due to the potential for unauthorized access to sensitive data and manipulation of message queues. An attacker who can exploit this vulnerability can read all messages passing through the Apache Artemis broker, potentially exposing confidential information like user credentials, financial data, or proprietary business logic. Furthermore, the ability to inject new messages allows an attacker to disrupt operations, inject malicious commands, or even gain further access to the underlying system. This vulnerability is particularly concerning within KNIME Business Hub environments where workflows and data processing pipelines rely on Apache Artemis for message routing.
CVE-2026-4649 is related to CVE-2026-27446, both impacting Apache Artemis. Public proof-of-concept (PoC) code is currently unavailable, but the vulnerability's nature suggests a relatively low barrier to exploitation. The vulnerability was publicly disclosed on 2026-03-24. The EPSS score is pending evaluation, but the potential for data exfiltration and system disruption warrants careful attention.
Organizations utilizing KNIME Business Hub with Apache Artemis integration are at risk, particularly those with users possessing executor privileges. Legacy KNIME deployments using older Apache Artemis versions are especially vulnerable. Shared hosting environments where multiple users share access to the Apache Artemis broker also face increased risk.
• linux / server:
journalctl -u apache-artemis -g "authentication bypass"• java / server:
Monitor Apache Artemis logs for unusual connection attempts or unauthorized message activity. Look for patterns indicative of message injection.
• generic web:
Check Apache Artemis configuration files for insecure settings or exposed endpoints. Use curl to probe for potential vulnerabilities.
disclosure
Statut de l'Exploit
EPSS
0.05% (percentile 14%)
CISA SSVC
The primary mitigation for CVE-2026-4649 is to upgrade Apache Artemis to version 1.17.4 or later. If upgrading is not immediately feasible, restrict access to the Apache Artemis broker to only authorized users and processes. Implement strict access controls within KNIME Business Hub to limit the ability of users to execute workflows in executors. Consider implementing a Web Application Firewall (WAF) to filter potentially malicious requests targeting the broker. After upgrading, verify the fix by attempting to connect to the Apache Artemis broker with unauthorized credentials and confirming that access is denied.
Mettez à jour KNIME Business Hub à la version 1.18.0, 1.17.4 ou 1.16.3, qui incluent une version corrigée d'Apache Artemis. Cela résoudra la vulnérabilité de contournement d'authentification et empêchera l'accès non autorisé aux messages internes.
Analyses de vulnérabilités et alertes critiques directement dans votre boîte mail.
CVE-2026-4649 is an authentication bypass vulnerability in Apache Artemis versions 0.0.0–1.17.4, allowing unauthorized message reading and injection. It affects KNIME Business Hub users with executor access.
You are affected if you are using Apache Artemis versions 0.0.0 through 1.17.4, or KNIME Business Hub that utilizes Apache Artemis and has users with executor privileges.
Upgrade Apache Artemis to version 1.17.4 or later. Restrict access to the broker and limit executor privileges in KNIME Business Hub as an interim measure.
While no active exploitation has been confirmed, the vulnerability's nature suggests a low barrier to exploitation, and it warrants immediate attention.
Refer to the Apache Artemis security page for updates and advisories: https://active.apache.org/
Téléverse ton fichier de dépendances et découvre instantanément si cette CVE et d'autres te touchent.
Téléverse ton fichier pom.xml et nous te dirons instantanément si tu es affecté.