Executive brief
Apache Artemis is a widely-used message broker that manages enterprise message queues and clustering. An unauthenticated attacker can connect to the broker and send a specially crafted request to discover sensitive information about the cluster's node topology before completing authentication, potentially enabling further attacks on the message broker infrastructure.
Technical details
The vulnerability is an information disclosure flaw in the CORE protocol handler of Apache Artemis. An attacker can send a SUBSCRIBE_TOPOLOGY request before completing the authentication handshake, allowing them to enumerate cluster node details without credentials. The attack requires network access to the broker's CORE protocol port and no user interaction. A successful exploit reveals cluster topology information that could facilitate reconnaissance or targeted attacks against the message broker cluster. Patches are available in version 2.57.0 and later.
Affected products
- Apache Artemis 2.50.0 through 2.56.0
- Apache ActiveMQ Artemis 1.0.0 through 2.44.0
Timeline
- 2026-09-10: disclosed: CVE-2026-49363 disclosed
- patched: Fixed in Apache Artemis version 2.57.0 and later