CVE-2026-67593: Apache Artemis Auth Bypass Vulnerability

CVE-2026-67593 Overview

CVE-2026-67593 is a missing authentication vulnerability [CWE-306] in Apache ActiveMQ Artemis. A remote attacker can craft an Openwire RemoveSubscriptionInfo command that deletes a queue on the Artemis broker before the connection reaches the authentication and authorization stage. The flaw affects Apache Artemis versions 2.50.0 through 2.56.0 and Apache ActiveMQ Artemis versions 1.0.0 through 2.44.0. The Apache project released version 2.57.0 to fix the issue.

Critical Impact
Unauthenticated remote attackers can delete arbitrary queues on an exposed Artemis broker, disrupting messaging flows and destroying pending messages.

Affected Products

Apache Artemis versions 2.50.0 through 2.56.0
Apache ActiveMQ Artemis versions 1.0.0 through 2.44.0
Deployments exposing the Openwire protocol listener to untrusted networks

Discovery Timeline

2026-09-10 - CVE-2026-67593 published to the National Vulnerability Database
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-67593

Vulnerability Analysis

Apache ActiveMQ Artemis supports the Openwire wire protocol for compatibility with legacy ActiveMQ clients. The Openwire command handling path processes certain frames before the broker completes client authentication and authorization. The RemoveSubscriptionInfo command, used to remove durable subscriptions, is dispatched to queue removal logic without confirming that a caller has permission to perform destructive operations. A remote attacker connecting to the Openwire port can send the crafted command and cause the broker to delete a targeted queue.

Because the check is missing at protocol dispatch, the same attack succeeds at any point during a session. An attacker does not need valid credentials, existing subscriptions, or prior state on the broker. Successful exploitation destroys the queue definition and any messages it holds, breaking downstream consumers that depend on that destination.

Root Cause

The root cause is missing authentication for a critical function [CWE-306]. The Openwire command handler treats RemoveSubscriptionInfo as a management operation that can proceed before the broker has established an authenticated principal for the connection. There is no authorization check gating the deletion against configured security roles.

Attack Vector

Exploitation requires network reachability to the Openwire acceptor, which defaults to TCP port 61616 in many Artemis deployments. The attacker opens a TCP connection, negotiates the Openwire handshake, and transmits a RemoveSubscriptionInfo command referencing the target queue by client and subscription identifier. The broker processes the command and removes the queue without prompting for credentials. No user interaction on the server side is required. See the Apache Mailing List Discussion and the Openwall OSS Security Update for protocol-level detail.

Detection Methods for CVE-2026-67593

Indicators of Compromise

Unexpected RemoveSubscriptionInfo entries in Artemis broker logs, particularly from connections that never completed SASL or JAAS authentication
Sudden disappearance of durable queues followed by client reconnect storms and consumer errors
Inbound TCP connections to the Openwire acceptor (default 61616) from addresses outside the messaging tier

Detection Strategies

Enable audit logging in broker.xml and alert on any queue deletion event that lacks an associated authenticated user identifier
Correlate Openwire connection events with queue lifecycle events to surface deletions that occur before authentication completes
Baseline expected RemoveSubscriptionInfo volume per client identifier and alert on deviations

Monitoring Recommendations

Forward Artemis broker and audit logs to a centralized analytics platform for retention and correlation
Monitor JMX metrics for queue count and message count deltas that indicate mass deletion
Track failed reconnect attempts from producers and consumers as a downstream signal of destroyed destinations

How to Mitigate CVE-2026-67593

Immediate Actions Required

Upgrade Apache ActiveMQ Artemis to version 2.57.0, which contains the vendor fix
Inventory all brokers exposing the Openwire acceptor and restrict network access to trusted producer and consumer subnets
Rotate any credentials that may have been captured from clients reconnecting to a compromised broker

Patch Information

The Apache ActiveMQ project fixed the issue in Artemis version 2.57.0. Operators running any release in the affected ranges should plan an upgrade rather than rely on configuration mitigations. Review the Apache Mailing List Discussion for the release announcement and upgrade guidance.

Workarounds

Disable the Openwire acceptor in broker.xml if legacy ActiveMQ clients are not required
Restrict the Openwire acceptor to loopback or an internal management VLAN using host firewalls or network ACLs
Terminate Openwire connections behind a TLS-enforcing proxy that requires client certificate authentication before the broker sees the traffic

bash

# Example: remove or comment out the Openwire acceptor in etc/broker.xml
# <acceptor name="artemis">tcp://0.0.0.0:61616?protocols=CORE,AMQP,STOMP,HORNETQ,MQTT,OPENWIRE;...</acceptor>
# Replace with a restricted acceptor that omits OPENWIRE:
# <acceptor name="artemis">tcp://0.0.0.0:61616?protocols=CORE,AMQP,STOMP,MQTT;...</acceptor>