プラットフォーム
java
コンポーネント
apache-artemis
修正版
1.17.4
1.16.3
1.15.2
CVE-2026-4649 describes an authentication bypass vulnerability affecting Apache Artemis versions prior to 2.52.0. This flaw allows an attacker with sufficient privileges to read all messages exchanged through the broker and inject new messages. KNIME Business Hub, which utilizes Apache Artemis, is also affected, particularly for users who can execute workflows within an executor.
The impact of CVE-2026-4649 is significant due to the potential for unauthorized access to sensitive data and manipulation of message queues. An attacker who can exploit this vulnerability can read all messages passing through the Apache Artemis broker, potentially exposing confidential information like user credentials, financial data, or proprietary business logic. Furthermore, the ability to inject new messages allows an attacker to disrupt operations, inject malicious commands, or even gain further access to the underlying system. This vulnerability is particularly concerning within KNIME Business Hub environments where workflows and data processing pipelines rely on Apache Artemis for message routing.
CVE-2026-4649 is related to CVE-2026-27446, both impacting Apache Artemis. Public proof-of-concept (PoC) code is currently unavailable, but the vulnerability's nature suggests a relatively low barrier to exploitation. The vulnerability was publicly disclosed on 2026-03-24. The EPSS score is pending evaluation, but the potential for data exfiltration and system disruption warrants careful attention.
Organizations utilizing KNIME Business Hub with Apache Artemis integration are at risk, particularly those with users possessing executor privileges. Legacy KNIME deployments using older Apache Artemis versions are especially vulnerable. Shared hosting environments where multiple users share access to the Apache Artemis broker also face increased risk.
• linux / server:
journalctl -u apache-artemis -g "authentication bypass"• java / server:
Monitor Apache Artemis logs for unusual connection attempts or unauthorized message activity. Look for patterns indicative of message injection.
• generic web:
Check Apache Artemis configuration files for insecure settings or exposed endpoints. Use curl to probe for potential vulnerabilities.
disclosure
エクスプロイト状況
EPSS
0.05% (14% パーセンタイル)
CISA SSVC
The primary mitigation for CVE-2026-4649 is to upgrade Apache Artemis to version 1.17.4 or later. If upgrading is not immediately feasible, restrict access to the Apache Artemis broker to only authorized users and processes. Implement strict access controls within KNIME Business Hub to limit the ability of users to execute workflows in executors. Consider implementing a Web Application Firewall (WAF) to filter potentially malicious requests targeting the broker. After upgrading, verify the fix by attempting to connect to the Apache Artemis broker with unauthorized credentials and confirming that access is denied.
KNIME Business Hubをバージョン1.18.0、1.17.4、または1.16.3に更新してください。これらのバージョンには、修正されたバージョンのApache Artemisが含まれています。これにより、認証バイパスの脆弱性が修正され、内部メッセージへの不正アクセスを防ぐことができます。
脆弱性分析と重要アラートをメールでお届けします。
CVE-2026-4649 is an authentication bypass vulnerability in Apache Artemis versions 0.0.0–1.17.4, allowing unauthorized message reading and injection. It affects KNIME Business Hub users with executor access.
You are affected if you are using Apache Artemis versions 0.0.0 through 1.17.4, or KNIME Business Hub that utilizes Apache Artemis and has users with executor privileges.
Upgrade Apache Artemis to version 1.17.4 or later. Restrict access to the broker and limit executor privileges in KNIME Business Hub as an interim measure.
While no active exploitation has been confirmed, the vulnerability's nature suggests a low barrier to exploitation, and it warrants immediate attention.
Refer to the Apache Artemis security page for updates and advisories: https://active.apache.org/
pom.xml ファイルをアップロードすると、影響の有無を即座にお知らせします。