CVE-2025-27391 Apache ActiveMQ Artemis: Passwords leaking from broker properties in the debug log

What is CVE-2025-27391?

CVE-2025-27391 is a medium-severity vulnerability in Apache ActiveMQ Artemis, published on 9 Apr 2025. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Insertion of Sensitive Information into Log File vulnerability in Apache ActiveMQ Artemis. All the values of the broker properties are logged when the org.apache.activemq.artemis.core.config.impl.ConfigurationImpl logger has the debug level enabled.

This issue affects Apache ActiveMQ Artemis: from 1.5.1 before 2.40.0. It can be mitigated by restricting log access to only trusted users.

Users are recommended to upgrade to version 2.40.0, which fixes the issue.

Weakness: CWE-532

Which versions are affected by CVE-2025-27391?

2 open source packages ship an affected version, including org.apache.activemq:artemis-project. It affects 1 product.

Products include Apache Artemis.

How do I fix CVE-2025-27391?

Upgrade org.apache.activemq:artemis-project to 2.40.0 or later.

Is CVE-2025-27391 being exploited?

There is no known exploitation of CVE-2025-27391 in the wild and no public exploit code.

Other vulnerabilities in Apache ActiveMQ Artemis

• CVE-2026-57967 Apache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session reattachment Critical 9.8
• CVE-2026-27446 Apache Artemis, Apache ActiveMQ Artemis: Auth bypass for Core downstream federation Critical 9.3
• CVE-2026-49364 Information disclosure in Apache ActiveMQ Artemis Critical 9.1
• CVE-2026-67593 Missing authorization in Apache ActiveMQ Artemis Critical 9.1
• CVE-2023-50780 Apache ActiveMQ Artemis: Authenticated users could perform RCE via Jolokia MBeans High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-pm4j-p7pm-fpvx, ROOT-APP-MAVEN-CVE-2025-27391.