CVE-2026-49363 Overview
CVE-2026-49363 is a pre-authentication information disclosure vulnerability in Apache ActiveMQ Artemis and Apache Artemis. An unauthenticated remote attacker connecting over the CORE protocol can send a SUBSCRIBE_TOPOLOGY request before completing authentication. The broker responds with cluster node details, exposing internal topology data to any network-reachable attacker.
The flaw affects Apache Artemis versions 2.50.0 through 2.56.0 and Apache ActiveMQ Artemis versions 1.0.0 through 2.44.0. The Apache project recommends upgrading to version 2.57.0, which enforces authentication before processing topology subscription requests.
Critical Impact
Unauthenticated remote attackers can enumerate cluster node addresses, ports, and topology information, enabling reconnaissance for follow-on attacks against broker infrastructure.
Affected Products
- Apache Artemis 2.50.0 through 2.56.0
- Apache ActiveMQ Artemis 1.0.0 through 2.44.0
- Fixed in Apache Artemis 2.57.0
Discovery Timeline
- 2026-09-10 - CVE-2026-49363 published to NVD
- 2026-09-10 - Last updated in NVD database
Technical Details for CVE-2026-49363
Vulnerability Analysis
Apache ActiveMQ Artemis is a widely deployed multi-protocol message broker. Clients connect using the CORE protocol, a binary wire format that supports clustering, failover, and topology discovery. In clustered deployments, brokers exchange node information through topology subscriptions so producers and consumers can locate cluster members.
The vulnerability [CWE-306: Missing Authentication for a Critical Function] allows a client to issue a SUBSCRIBE_TOPOLOGY packet on the CORE protocol before completing the authentication handshake. The broker processes the request and returns internal cluster topology data, including node identifiers and connector addresses.
Root Cause
The broker's CORE protocol handler does not enforce an authenticated session state before dispatching SUBSCRIBE_TOPOLOGY messages. Topology subscription is treated as a low-privilege management operation but reaches sensitive cluster metadata. The fix in version 2.57.0 gates the request behind the standard authentication check applied to other administrative packets.
Attack Vector
An attacker requires only network access to the broker's CORE listener, typically TCP port 61616. The attacker opens a socket, sends a valid SUBSCRIBE_TOPOLOGY packet, and reads the broker's topology response. No credentials, user interaction, or prior compromise is needed. Disclosed data can support pivoting to unexposed cluster members, targeted denial-of-service, or exploitation of secondary vulnerabilities on discovered nodes.
See the Apache Mailing List Thread and the OpenWall OSS Security Update for the maintainer disclosure.
Detection Methods for CVE-2026-49363
Indicators of Compromise
- Inbound TCP connections to CORE listener ports (default 61616) from unexpected sources that terminate shortly after a small packet exchange.
- Broker log entries showing topology subscriptions originating from client sessions with no preceding successful authentication event.
- Repeated short-lived connections from a single remote address enumerating multiple broker instances in a cluster.
Detection Strategies
- Correlate broker access logs with authentication logs to flag CORE sessions that issued protocol commands prior to an AUTH success event.
- Deploy network intrusion detection signatures for CORE protocol SUBSCRIBE_TOPOLOGY packets originating outside the trusted cluster subnet.
- Baseline expected topology subscribers (peer brokers, known clients) and alert on new source addresses.
Monitoring Recommendations
- Enable verbose CORE protocol logging on Artemis brokers to capture packet types and session state transitions.
- Forward broker logs to a centralized SIEM and build detections for pre-authentication protocol commands.
- Monitor perimeter firewalls for external exposure of TCP 61616 or other CORE acceptor ports.
How to Mitigate CVE-2026-49363
Immediate Actions Required
- Upgrade all Apache ActiveMQ Artemis and Apache Artemis brokers to version 2.57.0 or later.
- Inventory clusters to identify brokers running 1.0.0 through 2.44.0 (ActiveMQ Artemis) or 2.50.0 through 2.56.0 (Artemis).
- Restrict network access to CORE acceptor ports so only trusted application hosts and peer brokers can connect.
Patch Information
Apache has released Apache Artemis 2.57.0, which enforces authentication before processing SUBSCRIBE_TOPOLOGY requests on the CORE protocol. Review the Apache Mailing List Thread for upgrade guidance and the OpenWall OSS Security Update for advisory details.
Workarounds
- Place brokers behind a firewall or private network segment that blocks untrusted access to CORE listener ports.
- Bind the CORE acceptor to internal interfaces only and expose client-facing traffic through authenticated protocols such as AMQP over TLS with mutual authentication.
- Use network segmentation and allow-lists to restrict cluster topology traffic to known peer broker addresses until patching is complete.
# Example: restrict CORE listener to internal interface in broker.xml
# <acceptor name="artemis">tcp://10.0.0.10:61616?protocols=CORE;sslEnabled=true;needClientAuth=true</acceptor>
# Example iptables rule limiting CORE port to trusted subnet
iptables -A INPUT -p tcp --dport 61616 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 61616 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
