https://seclists.org/oss-sec/2026/q3/695: CVE-2026-49363: Apache Artemis, Apache ActiveMQ Artemis: P-Authentication Information Disclosuin COProtocol Topology Subscription

Q: What does an attacker need to exploit this issue?

An attacker only needs remote network access to an affected broker's CORE protocol endpoint. No authentication is required; the attacker sends a SUBSCRIBE_TOPOLOGY request before authenticating.

Q: What information can be exposed?

The issue allows discovery of cluster node details through topology subscription information. The provided information does not indicate exposure of broker credentials, messages, or other data.

Q: Which deployments are affected?

Affected deployments are those running Apache Artemis artemis-server versions 2.50.0 through 2.56.0 or Apache ActiveMQ Artemis artemis-server versions 1.0.0 through 2.44.0 and accepting remote CORE protocol connections.

Q: What is the available remediation?

Upgrade to version 2.57.0, which fixes the issue.

Published Sep 9, 2026

Updated

Affected Software

2 affected components

Apache ARTEMIS>=2.50.0<=2.56.0

Apache ActiveMQ Artemis>=1.0.0<=2.44.0

Frequently Asked Questions

What does an attacker need to exploit this issue?

An attacker only needs remote network access to an affected broker's CORE protocol endpoint. No authentication is required; the attacker sends a SUBSCRIBE_TOPOLOGY request before authenticating.

What information can be exposed?

The issue allows discovery of cluster node details through topology subscription information. The provided information does not indicate exposure of broker credentials, messages, or other data.

Which deployments are affected?

Affected deployments are those running Apache Artemis artemis-server versions 2.50.0 through 2.56.0 or Apache ActiveMQ Artemis artemis-server versions 1.0.0 through 2.44.0 and accepting remote CORE protocol connections.

What is the available remediation?

Upgrade to version 2.57.0, which fixes the issue.