CVE-2026-49363
Apache Artemis, Apache ActiveMQ Artemis: Pre-Authentication Information Disclosure in CORE Protocol Topology Subscription
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
An unauthenticated remote attacker connecting with the CORE protocol can discover cluster node details by sending a SUBSCRIBE_TOPOLOGY request prior to authentication. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0. Users are recommended to upgrade to version 2.57.0, which fixes the issue.
| CWE | CWE-306 |
| Vendor | apache software foundation |
| Product | apache artemis |
| Published | Sep 10, 2026 |
| Last Updated | Sep 10, 2026 |
Stay Ahead of the Next One
Get instant alerts for apache software foundation apache artemis
Be the first to know when new high vulnerabilities affecting apache software foundation apache artemis are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Apache Software Foundation / Apache Artemis
2.50.0 ≤ 2.56.0
Apache Software Foundation / Apache ActiveMQ Artemis
1.0.0 ≤ 2.44.0
References
Credits
Domenico Francesco Bruscino