CVE-2026-49363: Apache Artemis, Apache ActiveMQ Artemis: Pre-Authentication Information Disclosure in CORE Protocol Topology Subscription
CVE-2026-49363 lets unauthenticated attackers subscribe to ActiveMQ Artemis CORE topology and harvest cluster node details pre-authentication.
An unauthenticated remote attacker connecting with the CORE protocol can discover cluster node details by sending a SUBSCRIBE_TOPOLOGY request before authentication, tracked as CVE-2026-49363. The flaw affects artemis-server in Apache Artemis 2.50.0 through 2.56.0 and Apache ActiveMQ Artemis 1.0.0 through 2.44.0. Apache rates the issue as moderate; impact is limited to information disclosure of topology data.
- Pre-auth SUBSCRIBE_TOPOLOGY requests reveal cluster node details
- Affects artemis-server 2.50.0-2.56.0 and ActiveMQ Artemis 1.0.0-2.44.0
- Rated moderate; limited to information disclosure
- CVEs
- CVE-2026-49363
- Vendors
- Apache
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-49363 | Pre-Auth Topology Information Disclosure in Apache ActiveMQ Artemis CORE Protocol | 7.5 | <1% |
From the original article
Posted by Clebert Suconic on Sep 09 Severity: moderate Affected versions: - Apache Artemis (org. apache. artemis:artemis-server) 2.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.