CVE-2026-67593: Apache Artemis, Apache ActiveMQ Artemis: Pre-authentication Openwire protocol handling can result in queue deletion
CVE-2026-67593: remote attackers can delete ActiveMQ Artemis queues via pre-authentication Openwire protocol handling in affected versions.
A remote attacker can exploit pre-authentication handling of the Openwire protocol to result in queue deletion on affected Apache Artemis and ActiveMQ Artemis brokers. Affected components include artemis-openwire-protocol and artemis-jakarta-openwire-protocol in Apache Artemis 2.50.0 through 2.56.0, and artemis-openwire-protocol 1.0.0 through 2.44.0 plus artemis-jakarta-openwire-protocol 2.32.0 through 2.44.0 in ActiveMQ Artemis. Apache rates the issue important.
- Pre-authentication Openwire protocol handling allows remote queue deletion.
- Affects openwire and jakarta-openwire components in both Apache Artemis and ActiveMQ Artemis.
- Rated important by Apache; exposes brokers to destructive unauthenticated attacks.
- CVEs
- CVE-2026-67593
- Vendors
- Apache
- Products
- Apache ArtemisApache ActiveMQ
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-67593 | Pre-authentication queue deletion in Apache ActiveMQ Artemis via Openwire | 9.1 | <1% |
From the original article
Posted by Clebert Suconic on Sep 09 Severity: important Affected versions: - Apache Artemis (org. apache. artemis:artemis-openwire-protocol) 2.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.