CVE-2021-26118 Flaw in ActiveMQ Artemis OpenWire support

What is CVE-2021-26118?

CVE-2021-26118 is a high-severity missing authorization vulnerability in Netapp Oncommand Workflow Automation, published on 27 Jan 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

While investigating ARTEMIS-2964 it was found that the creation of advisory messages in the OpenWire protocol head of Apache ActiveMQ Artemis 2.15.0 bypassed policy based access control for the entire session. Production of advisory messages was not subject to access control in error.

Weakness: CWE-284

Which versions are affected by CVE-2021-26118?

2 open source packages ship an affected version, including org.apache.activemq:artemis-openwire-protocol. It affects 2 products.

Products include Apache Artemis, Netapp Oncommand Workflow Automation.

How do I fix CVE-2021-26118?

Upgrade org.apache.activemq:artemis-openwire-protocol to 2.16.0 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2021-26118 being exploited?

There is no known exploitation of CVE-2021-26118 in the wild and no public exploit code.

Other vulnerabilities in Netapp Oncommand Workflow Automation

• CVE-2026-57967 Apache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session reattachment Critical 9.8
• CVE-2026-27446 Apache Artemis, Apache ActiveMQ Artemis: Auth bypass for Core downstream federation Critical 9.3
• CVE-2026-49364 Information disclosure in Apache ActiveMQ Artemis Critical 9.1
• CVE-2026-67593 Missing authorization in Apache ActiveMQ Artemis Critical 9.1
• CVE-2023-50780 Apache ActiveMQ Artemis: Authenticated users could perform RCE via Jolokia MBeans High 8.8

All Netapp Oncommand Workflow Automation vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-q7fr-vqhq-v5xr, UBUNTU-CVE-2021-26118.