CVE-2026-49363

Analyzed Analyzed - Analysis Complete

Information Disclosure in Apache ActiveMQ Artemis

Publication date: 2026-09-10

Last updated on: 2026-09-16

Assigner: Apache Software Foundation

Description

An unauthenticated remote attacker connecting with the CORE protocol can discover cluster node details by sending a SUBSCRIBE_TOPOLOGY request prior to authentication. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0. Users are recommended to upgrade to version 2.57.0, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-10

Last Modified

2026-09-16

Generated

2026-09-30

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-29

NVD

CVE-2026-49363

EUVD

EUVD-2026-75249

Affected Vendors & Products

Vendor	Product	Version / Range
apache	artemis	From 2.50.0 (inc) to 2.57.0 (exc)
apache	artemis	From 1.0.0 (inc) to 2.44.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This vulnerability allows an unauthenticated remote attacker to send a SUBSCRIBE_TOPOLOGY request via the CORE protocol before authenticating. This request exposes details about the cluster nodes in Apache Artemis or Apache ActiveMQ Artemis.

Detection Guidance

To detect this vulnerability, monitor network traffic for SUBSCRIBE_TOPOLOGY requests sent via the CORE protocol before authentication. Check Apache Artemis logs for unauthorized topology requests or connections from unknown sources.

Impact Analysis

An attacker could use this to gather sensitive information about your cluster setup, potentially aiding further attacks. It does not directly allow data access but reveals infrastructure details that could be exploited.

Compliance Impact

This vulnerability could potentially affect compliance with GDPR and HIPAA by exposing cluster node details without authentication. Unauthorized access to topology information may lead to data breaches or unauthorized data exposure, which are violations of GDPR's data protection principles and HIPAA's security requirements for protecting sensitive health information.

Mitigation Strategies

Immediately upgrade Apache Artemis to version 2.57.0 or later. If using Apache ActiveMQ Artemis, upgrade to version 2.45.0 or later. Ensure no unauthenticated CORE protocol connections are allowed.

Hi! I’m here to help you understand CVE-2026-49363. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70