ZeroHour

CVE-2026-67593

large

Pre-authentication queue deletion in Apache ActiveMQ Artemis via Openwire

CVSS 3.1
9.1 critical
EPSS
<1%p21
Published
()
Modified
AI analysis

CVE-2026-67593 is a missing-authentication flaw (CWE-306) in the Openwire protocol handling of the Apache ActiveMQ Artemis message broker. A remote attacker can send a crafted Openwire RemoveSubscriptionInfo command that causes deletion of a queue on the broker before the connection authentication and authorization stage, or at any time thereafter. Because the command is accepted without authentication, an attacker with network access to the broker's Openwire interface can disrupt messaging operations by deleting queues without any valid credentials. All ActiveMQ Artemis versions from 1.0.0 through 2.44.0 and Artemis versions from 2.50.0 through 2.56.0 are affected, which covers essentially the product's entire version history. No public proof-of-concept, CISA KEV listing, or in-the-wild exploitation is currently known; the issue is fixed in version 2.57.0.

What to do: Upgrade to Apache ActiveMQ Artemis 2.57.0, which fixes the issue. As an interim mitigation, restrict network access to the Openwire acceptor (typically port 61616) so only trusted clients can reach it, and review broker logs for unexpected or unauthenticated RemoveSubscriptionInfo commands. Verify whether any brokers expose the Openwire port to untrusted networks or the internet, as those are the most exposed.

Affected
Apache Artemis2.50.0 through 2.56.0
Apache ActiveMQ Artemis1.0.0 through 2.44.0
Estimated exposure
largeestimated tens of thousands of broker deployments, of which thousands are likely internet-exposed — ActiveMQ Artemis is a widely deployed open-source message broker (default broker in Red Hat AMQ and embedded in application servers) and the affected range spans its entire 1.x-2.x history, while public internet scans have shown thousands…

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description

A remote attacker can craft an Openwire RemoveSubscriptionInfo command to cause the deletion of a queue on the Artemis broker before the connection authentication and authorization stage or at any time thereafter. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0. Users are recommended to upgrade to version 2.57.0, which fixes the issue.

Vendors
apache
Products
artemis
Weakness
CWE-306
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

In the news

CVE-2026-67593: Apache Artemis, Apache ActiveMQ Artemis: Pre-authentication Openwire protocol handling can result in queue deletion

CVE-2026-67593: remote attackers can delete ActiveMQ Artemis queues via pre-authentication Openwire protocol handling in affected versions.

A remote attacker can exploit pre-authentication handling of the Openwire protocol to result in queue deletion on affected Apache Artemis and ActiveMQ Artemis brokers. Affected components include artemis-openwire-protocol and artemis-jakarta-openwire-protocol in Apache Artemis 2.50.0 through 2.56.0, and artemis-openwire-protocol 1.0.0 through 2.44.0 plus artemis-jakarta-openwire-protocol 2.32.0 through 2.44.0 in ActiveMQ Artemis. Apache rates the issue important.

oss-security · 6d agoVulnerabilityCVE-2026-675931