{
  "threat_severity" : "Moderate",
  "public_date" : "2026-09-10T05:46:38Z",
  "bugzilla" : {
    "description" : "artemis-server: artemis-server: Pre-auth topology disclosure via CORE SUBSCRIBE_TOPOLOGY_V2 on channel0",
    "id" : "2492627",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2492627"
  },
  "cvss3" : {
    "cvss3_base_score" : "5.3",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
    "status" : "verified"
  },
  "cwe" : "CWE-306",
  "details" : [ "An unauthenticated remote attacker connecting with the CORE protocol can discover cluster node details by sending a SUBSCRIBE_TOPOLOGY request prior to authentication.\nThis issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0.\nUsers are recommended to upgrade to version 2.57.0, which fixes the issue.", "A missing authentication vulnerability was found in Apache ActiveMQ Artemis. The SUBSCRIBE_TOPOLOGY_V2 handler in CoreProtocolManager.LocalChannelHandler.handlePacket() processes topology subscription requests on channel0 with zero authentication -- no call to getSecurityStore(), no credential verification, no subject validation. An unauthenticated attacker can send a single 5-byte packet on the CORE protocol (via :8080 HTTP-upgrade in EAP or :61616 in AMQ Broker) to obtain the broker's nodeID (type-1 UUID embedding MAC address), internal hostname/IP, port numbers, connector configurations, and backup/scale-down group names. In clustered deployments, a persistent ClusterTopologyListener is registered that continuously pushes all topology changes to the unauthenticated client. This contrasts with the federation handler in the same file which was fixed via ARTEMIS-5928 (CVE-2026-27446). The leaked nodeID UUID seed directly enables session-name brute-force for REATTACH_SESSION session hijack." ],
  "affected_release" : [ {
    "product_name" : "Red Hat AMQ Broker 7.13.6",
    "release_date" : "2026-09-10T00:00:00Z",
    "advisory" : "RHSA-2026:66545",
    "cpe" : "cpe:/a:redhat:amq_broker:7.13",
    "package" : "artemis-server"
  }, {
    "product_name" : "Red Hat AMQ Broker 7.14.1",
    "release_date" : "2026-09-10T00:00:00Z",
    "advisory" : "RHSA-2026:66488",
    "cpe" : "cpe:/a:redhat:amq_broker:7.14",
    "package" : "artemis-server"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat build of Apache Camel for Spring Boot 4",
    "fix_state" : "Not affected",
    "package_name" : "artemis-server",
    "cpe" : "cpe:/a:redhat:camel_spring_boot:4"
  }, {
    "product_name" : "Red Hat Fuse 7",
    "fix_state" : "Not affected",
    "package_name" : "artemis-server",
    "cpe" : "cpe:/a:redhat:jboss_fuse:7"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7",
    "fix_state" : "Fix deferred",
    "package_name" : "artemis-server",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 8",
    "fix_state" : "Fix deferred",
    "package_name" : "artemis-server",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:8"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform Expansion Pack",
    "fix_state" : "Fix deferred",
    "package_name" : "artemis-server",
    "cpe" : "cpe:/a:redhat:jbosseapxp"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-49363\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-49363" ],
  "name" : "CVE-2026-49363",
  "mitigation" : {
    "value" : "1. Remove Core protocol from internet-facing acceptors -- configure the protocols parameter to exclude Core protocol on any acceptor receiving untrusted connections. In EAP, the :8080 HTTP-upgrade acceptor supports Core by default; restricting to AMQP/STOMP/OpenWire prevents the attack entirely.\n2. Enable mutual TLS -- configure sslEnabled=true with needClientAuth=true on all Core protocol acceptors. TLS handshake failure occurs before any protocol-level packet can be sent.\n3. Disable HTTP-upgrade for Core protocol if not required -- remove the http-upgrade element from the Artemis acceptor configuration to eliminate the :8080 attack surface.",
    "lang" : "en:us"
  },
  "csaw" : false
}