CVE-2026-67593: Apache Artemis, Apache ActiveMQ Artemis: Pre-authentication Openwire protocol handling can result in queue deletion

CVE-2026-67593 is a missing-authentication flaw (CWE-306) in the Openwire protocol handling of the Apache ActiveMQ Artemis message broker. A remote attacker can send a crafted Openwire RemoveSubscriptionInfo command that causes deletion of a queue on the broker before the connection authentication and authorization stage, or at any time thereafter. Because the command is accepted without authentication, an attacker with network access to the broker's Openwire interface can disrupt messaging operations by deleting queues without any valid credentials. All ActiveMQ Artemis versions from 1.0.0 through 2.44.0 and Artemis versions from 2.50.0 through 2.56.0 are affected, which covers essentially the product's entire version history. No public proof-of-concept, CISA KEV listing, or in-the-wild exploitation is currently known; the issue is fixed in version 2.57.0.

Do: Upgrade to Apache ActiveMQ Artemis 2.57.0, which fixes the issue. As an interim mitigation, restrict network access to the Openwire acceptor (typically port 61616) so only trusted clients can reach it, and review broker logs for unexpected or unauthenticated RemoveSubscriptionInfo commands. Verify whether any brokers expose the Openwire port to untrusted networks or the internet, as those are the most exposed.