CVE-2026-49363: Apache Artemis, Apache ActiveMQ Artemis: Pre-Authentication Information Disclosure in CORE Protocol Topology Subscription
CVE-2026-49363 lets unauthenticated attackers subscribe to ActiveMQ Artemis CORE topology and harvest cluster node details pre-authentication.
An unauthenticated remote attacker connecting with the CORE protocol can discover cluster node details by sending a SUBSCRIBE_TOPOLOGY request before authentication, tracked as CVE-2026-49363. The flaw affects artemis-server in Apache Artemis 2.50.0 through 2.56.0 and Apache ActiveMQ Artemis 1.0.0 through 2.44.0. Apache rates the issue as moderate; impact is limited to information disclosure of topology data.
- Pre-auth SUBSCRIBE_TOPOLOGY requests reveal cluster node details
- Affects artemis-server 2.50.0-2.56.0 and ActiveMQ Artemis 1.0.0-2.44.0
- Rated moderate; limited to information disclosure
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-49363 | Pre-Auth Topology Information Disclosure in Apache ActiveMQ Artemis CORE Protocol CVE-2026-49363 is a missing-authentication flaw (CWE-306) in the CORE protocol of Apache ActiveMQ Artemis/Apache Artemis that allows an unauthenticated remote client to learn cluster topology details. An attacker connects to the broker's CORE acceptor and sends a SUBSCRIBE_TOPOLOGY request before authenticating, receiving cluster node information in response. The disclosure is limited to cluster node details, but it gives outsiders reconnaissance material about the messaging infrastructure that could support targeted follow-on attacks. Any deployment running Apache Artemis 2.50.0-2.56.0 or Apache ActiveMQ Artemis 1.0.0-2.44.0 that accepts untrusted CORE connections is affected, which spans essentially the project's entire release history. There is no public proof-of-concept, no CISA KEV listing, no CVSS score yet, and no known exploitation reported. Do: Upgrade to Apache Artemis 2.57.0, which fixes the issue. Until patched, restrict network access to the broker's CORE protocol acceptor so that only trusted clients and networks can connect, and audit which environments expose it externally. Monitor for the forthcoming CVSS score and any published proof-of-concept. | 7.5 | <1% |
| largetens of thousands of broker deployments (public internet scans routinely show tens of thousands of exposed ActiveMQ-family brokers) |
Posted by Clebert Suconic on Sep 09 Severity: moderate Affected versions: - Apache Artemis (org.apache.artemis:artemis-server) 2.50.0 through 2.56.0 - Apache ActiveMQ Artemis (org.apache.activemq:artemis-server) 1.0.0 through 2.44.0 Description: An unauthenticated remote attacker connecting with the CORE protocol can discover cluster node details by sending a SUBSCRIBE_TOPOLOGY request prior to authentication. This issue affects Apache Artemis: from 2.50.0 through 2.56.0;...
This source does not provide full text. Read it at seclists.org.