Bug 2482965

see detailed analysis: https://docs.google.com/document/d/1XdX8AJzGjBgCLE0UZ5N_RGGrzQ14HSVS8HcDgH0X70w/edit?tab=t.6q218rre4ubh#bookmark=id.gja8pl1bilun

On products where CVE-2026-27446 is unpatched (e.g., JBoss EAP 7.4 ELS1), the SSRF and connector injection are reachable pre-auth (PR:N). The combined effective severity in that context is 7.2 High (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N). This aligns with the external report's original "High (Important)" classification and should be noted in the Red Hat impact statement for the new CVE.

Apache ActiveMQ Artemis contains an SSRF and connector injection vulnerability in the FEDERATION_DOWNSTREAM_CONNECT packet handler in CoreProtocolManager. An authenticated federation peer can send a crafted federation packet with arbitrary TransportConfiguration parameters (host, port). The handler applies these parameters via params.putAll(), overriding the acceptor's own configuration, and then calls server.getFederationManager().deploy() which initiates an outbound TCP connection to the attacker-controlled destination. Additionally, server.getConfiguration().addConnectorConfiguration() injects rogue connector definitions into the broker's runtime topology without validation.

This enables: (1) SSRF — outbound connections to arbitrary internal hosts including cloud metadata endpoints, internal APIs, and private network services; (2) connector injection — runtime-persistent modification of the broker's connector topology, potentially overwriting legitimate connectors.

This is a defense-in-depth issue — the primary access control is federation peer authentication (CVE-2026-27446). However, the handler should independently validate TransportConfiguration parameters to protect against compromised peers, future auth bypasses, and products where the auth fix is not applied.