CVE-2021-26118

Flaw in ActiveMQ Artemis OpenWire support

7.5 HighFix available

While investigating ARTEMIS-2964 it was found that the creation of advisory messages in the OpenWire protocol head of Apache ActiveMQ Artemis 2.15.0 bypassed policy based access control for the entire session. Production of advisory messages was not subject to access control in error.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: High
Availability: None

Exploit likelihood

3.86%Up 2.0 points since Apr 14, 2021

What each source reports

NVD Score used 7.5

Record: CVE-2021-26118
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:N/I:P/A:N
Weakness: CWE-284
Updated: 2026-11-02

CVE List No score

Flaw in ActiveMQ Artemis OpenWire support

Record: CVE-2021-26118
Weakness: CWE-284
Updated: 2026-11-02

EUVDEUVD-2021-1379 0.0

Record: EUVD-2021-1379
CVSS: 0.0 NoneCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-03

GitHub AdvisoriesGHSA-q7fr-vqhq-v5xr 7.5

Apache ActiveMQ Artemis vulnerable to Improper Access Control

Record: GHSA-q7fr-vqhq-v5xr
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-284, CWE-287
Updated: 2026-11-02

OSV 7.5

Record: CVE-2021-26118
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

OSVGHSA-q7fr-vqhq-v5xr 7.5

Apache ActiveMQ Artemis vulnerable to Improper Access Control

Record: GHSA-q7fr-vqhq-v5xr
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-284, CWE-287
Updated: 2026-11-02

OSVUBUNTU-CVE-2021-26118 7.5

Record: UBUNTU-CVE-2021-26118
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.apache.activemq:artemis-openwire-protocol` Maven	before 2.16.0	2.16.0
`org.apache.activemq:artemis-openwire-protocol` Maven	before 2.16.0, plus listed versions 1.0.01.1.01.2.01.3.01.4.0 Show 29 moreShow less 1.5.01.5.11.5.21.5.31.5.41.5.51.5.62.0.02.1.02.10.02.10.12.11.02.12.02.13.02.14.02.15.02.2.02.3.02.4.02.5.02.6.02.6.12.6.22.6.32.6.42.7.02.8.02.8.12.9.0	2.16.0
`activemq` Ubuntu:Pro:16.04:LTS	All versions, plus listed versions 5.6.0+dfsg1-4+deb8u1ubuntu15.6.0+dfsg1-55.13.2+dfsg-25.13.2+dfsg-2ubuntu0.1~esm1	None known
`activemq` Ubuntu:Pro:18.04:LTS	All versions, plus listed versions 5.14.5-35.15.2-25.15.3-25.15.8-2~18.045.15.8-2~18.04.1~esm1	None known
`activemq` Ubuntu:Pro:20.04:LTS	All versions, plus listed versions 5.15.10-15.15.11-15.15.11-1ubuntu0.1~esm1	None known
`activemq` Ubuntu:Pro:22.04:LTS	All versions, plus listed versions 5.16.1-15.16.1-1ubuntu0.1~esm15.16.1-1ubuntu0.1	None known

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-26118 is a high vulnerability (CVSS 7.5) in Apache Artemis, published January 27, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.86%, the 90th percentile. Fixed in org.apache.activemq:artemis-openwire-protocol 2.16.0.

References

Show 4 moreShow less