CVE-2025-4057 Activemq-artemis-operator: amq broker operator starting credentials reuse
The ActiveMQ Artemis operator reuses generated passwords across separate custom resources, allowing attackers to access multiple brokers with the same credentials.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-4057?
CVE-2025-4057 is a medium-severity vulnerability in Red Hat AMQ Broker 7.13.0.OPR.1.GA, published on 26 May 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A flaw was found in ActiveMQ Artemis. The password generated by activemq-artemis-operator does not regenerate between separated CR dependencies.
Weakness: CWE-1391
Which versions are affected by CVE-2025-4057?
3 open source packages ship an affected version, including github.com/arkmq-org/activemq-artemis-operator.
| Package | Affected | Fixed in |
|---|---|---|
github.com/arkmq-org/activemq-artemis-operator Go | All versions | None |
github.com/arkmq-org/activemq-artemis-operator Go | All versions to 0.0.0-20250418141202-b262048e6a75 | None |
github.com/arkmq-org/activemq-artemis-operator Go | All versions to 0.0.0-20250418141202-b262048e6a75 | None |
How do I fix CVE-2025-4057?
Apply the vendor's patch.
Is CVE-2025-4057 being exploited?
There is no known exploitation of CVE-2025-4057 in the wild and no public exploit code.
Sources
Also known as GHSA-q5q7-8x6x-hcg2, GO-2025-3717.