CVE-2026-67593: Apache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-authentication Openwire protocol handling can result in queue deletion
A remote attacker can craft an Openwire RemoveSubscriptionInfo command to cause the deletion of a queue on the Artemis broker before the connection authentication and authorization stage or at any time thereafter.
This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0.
Users are recommended to upgrade to version 2.57.0, which fixes the issue.
Other sources
Source: Internal security audit — AMQ Broker f005 Upstream project: Apache ActiveMQ Artemis Upstream advisory: None — pending report to security
Affected code: - OpenWireConnection.java — processRemoveSubscription() executes pre-auth, calls server.destroyQueue(SimpleString) with null SecurityAuth, skipping authorization check entirely
Fix status: No upstream fix available. Vulnerability confirmed in upstream versions 2.33.0, 2.40.0, 2.55.0 (latest) and downstream AMQ Broker 7.14 GA.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache ActiveMQ Artemisto a version that resolves this vulnerability.Fixed in 2.57.0
Event History
Frequently Asked Questions
Does exploitation require valid broker credentials?
No. A remote attacker can send a crafted Openwire RemoveSubscriptionInfo command before connection authentication and authorization occur. The command can also be used after that stage.
Which deployments should be upgraded?
Apache Artemis versions 2.50.0 through 2.56.0 and Apache ActiveMQ Artemis versions 1.0.0 through 2.44.0 are affected. Upgrade to version 2.57.0, which fixes the issue.