AI analysis
CVE-2026-67593 is a missing-authentication flaw (CWE-306) in the Openwire protocol handling of the Apache ActiveMQ Artemis message broker. A remote attacker can send a crafted Openwire RemoveSubscriptionInfo command that causes deletion of a queue on the broker before the connection authentication and authorization stage, or at any time thereafter. Because the command is accepted without authentication, an attacker with network access to the broker's Openwire interface can disrupt messaging operations by deleting queues without any valid credentials. All ActiveMQ Artemis versions from 1.0.0 through 2.44.0 and Artemis versions from 2.50.0 through 2.56.0 are affected, which covers essentially the product's entire version history. No public proof-of-concept, CISA KEV listing, or in-the-wild exploitation is currently known; the issue is fixed in version 2.57.0.
What to do: Upgrade to Apache ActiveMQ Artemis 2.57.0, which fixes the issue. As an interim mitigation, restrict network access to the Openwire acceptor (typically port 61616) so only trusted clients can reach it, and review broker logs for unexpected or unauthenticated RemoveSubscriptionInfo commands. Verify whether any brokers expose the Openwire port to untrusted networks or the internet, as those are the most exposed.
Affected
| Apache Artemis | 2.50.0 through 2.56.0 |
| Apache ActiveMQ Artemis | 1.0.0 through 2.44.0 |
Estimated exposure
largeestimated tens of thousands of broker deployments, of which thousands are likely internet-exposed — ActiveMQ Artemis is a widely deployed open-source message broker (default broker in Red Hat AMQ and embedded in application servers) and the affected range spans its entire 1.x-2.x history, while public internet scans have shown thousands…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
A remote attacker can craft an Openwire RemoveSubscriptionInfo command to cause the deletion of a queue on the Artemis broker before the connection authentication and authorization stage or at any time thereafter. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0. Users are recommended to upgrade to version 2.57.0, which fixes the issue.