{
  "threat_severity" : "Important",
  "public_date" : "2026-09-10T05:32:43Z",
  "bugzilla" : {
    "description" : "artemis-openwire-protocol: AMQ Broker Artemis: pre-authentication arbitrary durable queue deletion via OpenWire RemoveSubscriptionInfo",
    "id" : "2510277",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2510277"
  },
  "cvss3" : {
    "cvss3_base_score" : "8.2",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-306",
  "details" : [ "A remote attacker can craft an Openwire RemoveSubscriptionInfo command to cause the deletion of a queue on the Artemis broker before the connection authentication and authorization stage or at any time thereafter. \nThis issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0.\nUsers are recommended to upgrade to version 2.57.0, which fixes the issue.", "An unauthenticated network attacker can delete arbitrary durable queues on any Apache Artemis broker with OpenWire protocol enabled (default). The processRemoveSubscription() method executes pre-authentication with no authorization check, and uses the internal destroyQueue(SimpleString) overload that skips security entirely. Default queues DLQ and ExpiryQueue are trivially targetable. This is unfixed in all Artemis versions through 2.55.0." ],
  "affected_release" : [ {
    "product_name" : "Red Hat AMQ Broker 7.13.6",
    "release_date" : "2026-09-10T00:00:00Z",
    "advisory" : "RHSA-2026:66545",
    "cpe" : "cpe:/a:redhat:amq_broker:7.13",
    "package" : "artemis-openwire-protocol"
  }, {
    "product_name" : "Red Hat AMQ Broker 7.14.1",
    "release_date" : "2026-09-10T00:00:00Z",
    "advisory" : "RHSA-2026:66488",
    "cpe" : "cpe:/a:redhat:amq_broker:7.14",
    "package" : "artemis-openwire-protocol"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat build of Apache Camel for Spring Boot 4",
    "fix_state" : "Not affected",
    "package_name" : "artemis-openwire-protocol",
    "cpe" : "cpe:/a:redhat:camel_spring_boot:4"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7",
    "fix_state" : "Not affected",
    "package_name" : "artemis-openwire-protocol",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 8",
    "fix_state" : "Not affected",
    "package_name" : "artemis-openwire-protocol",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:8"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform Expansion Pack",
    "fix_state" : "Not affected",
    "package_name" : "artemis-openwire-protocol",
    "cpe" : "cpe:/a:redhat:jbosseapxp"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-67593\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-67593" ],
  "name" : "CVE-2026-67593",
  "mitigation" : {
    "value" : "1. Remove OpenWire from acceptors — edit broker.xml, remove OPENWIRE from protocols parameter\n2. Firewall — restrict port 61616 to trusted clients if OpenWire cannot be disabled\n3. Monitor — watch for \"AMQ601069: destroyed queue: <name>\" in broker logs",
    "lang" : "en:us"
  },
  "csaw" : false
}