Bug 2480638 (CVE-2026-57967)

Summary:	CVE-2026-57967 artemis-server: Apache Artemis — session hijack via missing authentication
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	anujha, asoldano, ataylor, bbaranow, bmaxwell, bstansbe, dbruscin, dlofthou, ehugonne, istudens, ivassile, iweiss, kvanderr, mosmerov, msvehla, nwallace, pberan, pesilva, pjindal, pmackay, rstancel, security-response-team, smaestri, thjenkin, vdosoudi
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	in Apache Artemis, the REATTACH_SESSION handler performs zero authentication — it looks up the session by name only and calls transferConnection() unconditionally, migrating the authenticated session to the attacker's connection. The hijacked cluster-bridge session inherits full broker-management authority (message injection, topology manipulation, journal access)	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-05-21 21:32:24 UTC

indepth analysis: https://docs.google.com/document/d/1XdX8AJzGjBgCLE0UZ5N_RGGrzQ14HSVS8HcDgH0X70w/edit?tab=t.d440c4doqxdr#bookmark=kix.ffo7qhxjskp1

The finding correctly identifies a composite attack chain where an unauthenticated attacker exploits three independently verified weaknesses in the Artemis CORE protocol: (1) the SUBSCRIBE_TOPOLOGY_V2 handler on channel0 leaks the broker's nodeID (a type-1 UUID) without authentication, revealing the MAC address and clock sequence embedded in the UUID; (2) cluster-bridge sessions are named using type-1 UUIDs generated by the same UUIDGenerator instance with the same MAC/clock-sequence seed, making session names predictable to within ~10,000 candidates (the number of 100ns intervals per millisecond); (3) the REATTACH_SESSION handler (ActiveMQPacketHandler.handleReattachSession()) performs zero authentication — it looks up the session by name only and calls transferConnection() unconditionally, migrating the authenticated session to the attacker's connection. The hijacked cluster-bridge session inherits full broker-management authority (message injection, topology manipulation, journal access)

Comment 3 errata-xmlrpc 2026-09-10 16:35:19 UTC

This issue has been addressed in the following products:

  Red Hat AMQ Broker 7.14.1

Via RHSA-2026:66488 https://access.redhat.com/errata/RHSA-2026:66488

Comment 4 errata-xmlrpc 2026-09-10 23:23:34 UTC

This issue has been addressed in the following products:

  Red Hat AMQ Broker 7.13.6

Via RHSA-2026:66545 https://access.redhat.com/errata/RHSA-2026:66545

Comment 5 Jon Orris 2026-09-15 14:41:15 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.4.25

Via RHSA-2026:67603 https://access.redhat.com/errata/RHSA-2026:67603

Comment 6 Jon Orris 2026-09-15 14:44:34 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
  Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8
  Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9

Via RHSA-2026:67604 https://access.redhat.com/errata/RHSA-2026:67604

Comment 7 Jon Orris 2026-09-22 12:56:17 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8

Via RHSA-2026:70228 https://access.redhat.com/errata/RHSA-2026:70228

Comment 8 Jon Orris 2026-09-22 12:58:45 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10

Via RHSA-2026:70230 https://access.redhat.com/errata/RHSA-2026:70230

Comment 9 Jon Orris 2026-09-22 13:00:50 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9

Via RHSA-2026:70229 https://access.redhat.com/errata/RHSA-2026:70229

Comment 10 Jon Orris 2026-09-22 15:35:51 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 8.1

Via RHSA-2026:70277 https://access.redhat.com/errata/RHSA-2026:70277