CVE-2021-26118

While investigating ARTEMIS-2964 it was found that the creation of advisory messages in the OpenWire protocol head of Apache ActiveMQ Artemis 2.15.0 bypassed policy based access control for the entire session. Production of advisory messages was not subject to access control in error.

• CWE-284

• https://lists.apache.org/thread.html/rafd5d7cf303772a0118865262946586921a65ebd98fc24f56c812574%40%3Cannounce.apache.org%3E
• https://mail-archives.apache.org/mod_mbox/activemq-users/202101.mbox/%3CCAH%2BvQmMUNnkiXv2-d3ucdErWOsdnLi6CgnK%2BVfixyJvTgTuYig%40mail.gmail.com%3EMailing List, Vendor Advisory
• https://security.netapp.com/advisory/ntap-20210827-0002/Third Party Advisory
• https://lists.apache.org/thread.html/rafd5d7cf303772a0118865262946586921a65ebd98fc24f56c812574%40%3Cannounce.apache.org%3E
• https://mail-archives.apache.org/mod_mbox/activemq-users/202101.mbox/%3CCAH%2BvQmMUNnkiXv2-d3ucdErWOsdnLi6CgnK%2BVfixyJvTgTuYig%40mail.gmail.com%3EMailing List, Vendor Advisory
• https://security.netapp.com/advisory/ntap-20210827-0002/Third Party Advisory

Published

Jan 27, 2021

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-26112Multiple stack-based buffer overflow vulnerabilities [CWE-12…9.8
• CVE-2021-26113A use of a one-way hash with a predictable salt vulnerabilit…7.5
• CVE-2021-26114Multiple improper neutralization of special elements used in…9.8
• CVE-2021-26115An OS command injection (CWE-78) vulnerability in FortiWAN v…7.8
• CVE-2021-26116An improper neutralization of special elements used in an OS…8.8
• CVE-2021-26117The optional ActiveMQ LDAP login module can be configured to…7.5
• CVE-2021-26119Smarty before 3.1.39 allows a Sandbox Escape because $smarty…7.5
• CVE-2021-26120Smarty before 3.1.39 allows code injection via an unexpected…9.8
• CVE-2021-26122LivingLogic XIST4C before 0.107.8 allows XSS via feedback.ht…6.1
• CVE-2021-26123LivingLogic XIST4C before 0.107.8 allows XSS via login.htm, …6.1
• CVE-2021-26194An issue was discovered in JerryScript 2.4.0. There is a hea…6.5
• CVE-2021-26195An issue was discovered in JerryScript 2.4.0. There is a hea…8.8