Pre-Auth Topology Information Disclosure in Apache ActiveMQ Artemis CORE Protocol
AI analysis
CVE-2026-49363 is a missing-authentication flaw (CWE-306) in the CORE protocol of Apache ActiveMQ Artemis/Apache Artemis that allows an unauthenticated remote client to learn cluster topology details. An attacker connects to the broker's CORE acceptor and sends a SUBSCRIBE_TOPOLOGY request before authenticating, receiving cluster node information in response. The disclosure is limited to cluster node details, but it gives outsiders reconnaissance material about the messaging infrastructure that could support targeted follow-on attacks. Any deployment running Apache Artemis 2.50.0-2.56.0 or Apache ActiveMQ Artemis 1.0.0-2.44.0 that accepts untrusted CORE connections is affected, which spans essentially the project's entire release history. There is no public proof-of-concept, no CISA KEV listing, no CVSS score yet, and no known exploitation reported.
What to do: Upgrade to Apache Artemis 2.57.0, which fixes the issue. Until patched, restrict network access to the broker's CORE protocol acceptor so that only trusted clients and networks can connect, and audit which environments expose it externally. Monitor for the forthcoming CVSS score and any published proof-of-concept.
Affected
| Apache Artemis | 2.50.0 through 2.56.0 |
| Apache ActiveMQ Artemis | 1.0.0 through 2.44.0 |
Estimated exposure
largetens of thousands of broker deployments (public internet scans routinely show tens of thousands of exposed ActiveMQ-family brokers) — ActiveMQ Artemis is one of the most widely deployed open-source message brokers, with public internet scans typically showing tens of thousands of exposed ActiveMQ-family instances and a substantially larger installed base of internal and…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
An unauthenticated remote attacker connecting with the CORE protocol can discover cluster node details by sending a SUBSCRIBE_TOPOLOGY request prior to authentication. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0. Users are recommended to upgrade to version 2.57.0, which fixes the issue.