{"api_version":"1","generated_at":"2026-04-22T17:48:41+00:00","cve":"CVE-2021-26118","urls":{"html":"https://cve.report/CVE-2021-26118","api":"https://cve.report/api/cve/CVE-2021-26118.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2021-26118","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2021-26118"},"summary":{"title":"CVE-2021-26118","description":"While investigating ARTEMIS-2964 it was found that the creation of advisory messages in the OpenWire protocol head of Apache ActiveMQ Artemis 2.15.0 bypassed policy based access control for the entire session. Production of advisory messages was not subject to access control in error.","state":"PUBLIC","assigner":"security@apache.org","published_at":"2021-01-27 19:15:00","updated_at":"2023-11-07 03:31:00"},"problem_types":["NVD-CWE-Other"],"metrics":[],"references":[{"url":"https://mail-archives.apache.org/mod_mbox/activemq-users/202101.mbox/%3CCAH%2BvQmMUNnkiXv2-d3ucdErWOsdnLi6CgnK%2BVfixyJvTgTuYig%40mail.gmail.com%3E","name":"https://mail-archives.apache.org/mod_mbox/activemq-users/202101.mbox/%3CCAH%2BvQmMUNnkiXv2-d3ucdErWOsdnLi6CgnK%2BVfixyJvTgTuYig%40mail.gmail.com%3E","refsource":"MISC","tags":["Mailing List","Vendor Advisory"],"title":"CVE-2021-26118: Flaw in ActiveMQ Artemis OpenWire support","mime":"text/xml","httpstatus":"200","archivestatus":"0"},{"url":"https://security.netapp.com/advisory/ntap-20210827-0002/","name":"https://security.netapp.com/advisory/ntap-20210827-0002/","refsource":"CONFIRM","tags":[],"title":"CVE-2021-26118 Apache ActiveMQ Artemis Vulnerability in NetApp Products | NetApp Product Security","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://lists.apache.org/thread.html/rafd5d7cf303772a0118865262946586921a65ebd98fc24f56c812574@%3Cannounce.apache.org%3E","name":"[announce] 20210127 CVE-2021-26118: Flaw in ActiveMQ Artemis OpenWire support","refsource":"MLIST","tags":["Mailing List","Patch","Vendor Advisory"],"title":"Pony Mail!","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://lists.apache.org/thread.html/rafd5d7cf303772a0118865262946586921a65ebd98fc24f56c812574%40%3Cannounce.apache.org%3E","name":"[announce] 20210127 CVE-2021-26118: Flaw in ActiveMQ Artemis OpenWire support","refsource":"","tags":[],"title":"","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-26118","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-26118","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"LEGACY","value":"Apache ActiveMQ  would like to thank Francesco Marchioni (Red Hat) for reporting this issue.","lang":""}],"nvd_cpes":[{"cve_year":"2021","cve_id":"26118","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"apache","cpe5":"activemq_artemis","cpe6":"2.15.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"26118","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"apache","cpe5":"activemq_artemis","cpe6":"2.15.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"26118","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"netapp","cpe5":"oncommand_workflow_automation","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[{"cve":"CVE-2021-26118","qid":"981417","title":"Java (maven) Security Update for org.apache.activemq:apache-artemis (GHSA-q7fr-vqhq-v5xr)"}]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"security@apache.org","ID":"CVE-2021-26118","STATE":"PUBLIC","TITLE":"Flaw in ActiveMQ Artemis OpenWire support"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Apache ActiveMQ Artemis","version":{"version_data":[{"version_affected":"<","version_value":"2.16.0"}]}}]},"vendor_name":"Apache Software Foundation"}]}},"credit":[{"lang":"eng","value":"Apache ActiveMQ  would like to thank Francesco Marchioni (Red Hat) for reporting this issue."}],"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"While investigating ARTEMIS-2964 it was found that the creation of advisory messages in the OpenWire protocol head of Apache ActiveMQ Artemis 2.15.0 bypassed policy based access control for the entire session. Production of advisory messages was not subject to access control in error."}]},"generator":{"engine":"Vulnogram 0.0.9"},"impact":[],"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-284 Improper Access Control"}]}]},"references":{"reference_data":[{"refsource":"MISC","url":"https://mail-archives.apache.org/mod_mbox/activemq-users/202101.mbox/%3CCAH%2BvQmMUNnkiXv2-d3ucdErWOsdnLi6CgnK%2BVfixyJvTgTuYig%40mail.gmail.com%3E","name":"https://mail-archives.apache.org/mod_mbox/activemq-users/202101.mbox/%3CCAH%2BvQmMUNnkiXv2-d3ucdErWOsdnLi6CgnK%2BVfixyJvTgTuYig%40mail.gmail.com%3E"},{"refsource":"MLIST","name":"[announce] 20210127 CVE-2021-26118: Flaw in ActiveMQ Artemis OpenWire support","url":"https://lists.apache.org/thread.html/rafd5d7cf303772a0118865262946586921a65ebd98fc24f56c812574@%3Cannounce.apache.org%3E"},{"refsource":"CONFIRM","name":"https://security.netapp.com/advisory/ntap-20210827-0002/","url":"https://security.netapp.com/advisory/ntap-20210827-0002/"}]},"source":{"defect":["https://issues.apache.org/jira/browse/ARTEMIS-2964"],"discovery":"UNKNOWN"},"work_around":[{"lang":"eng","value":"Upgrade to Apache ActiveMQ Artemis 2.16.0"}]},"nvd":{"publishedDate":"2021-01-27 19:15:00","lastModifiedDate":"2023-11-07 03:31:00","problem_types":["NVD-CWE-Other"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE","baseScore":5},"severity":"MEDIUM","exploitabilityScore":10,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:apache:activemq_artemis:2.15.0:*:*:*:*:*:*:*","cpe_name":[]}]},{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2021","CveId":"26118","Ordinal":"201062","Title":"CVE-2021-26118","CVE":"CVE-2021-26118","Year":"2021"},"notes":[{"CveYear":"2021","CveId":"26118","Ordinal":"1","NoteData":"While investigating ARTEMIS-2964 it was found that the creation of advisory messages in the OpenWire protocol head of Apache ActiveMQ Artemis 2.15.0 bypassed policy based access control for the entire session. Production of advisory messages was not subject to access control in error.","Type":"Description","Title":null},{"CveYear":"2021","CveId":"26118","Ordinal":"2","NoteData":"2021-01-27","Type":"Other","Title":"Published"},{"CveYear":"2021","CveId":"26118","Ordinal":"3","NoteData":"2021-08-27","Type":"Other","Title":"Modified"}]}}}