As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-49363: Apache Artemis, Apache ActiveMQ Artemis: Pre-Authentication Information Disclosure in CORE Protocol Topology Subscription
CVE-2026-49363 affects Apache Artemis and ActiveMQ Artemis, allowing unauthenticated attackers to discover cluster node details by submitting a SUBSCRIBE_TOPOLOGY request over the CORE protocol before completing authentication. Versions 2.50.0 through 2.56.0 of Artemis and 1.0.0 through 2.44.0 of ActiveMQ Artemis are vulnerable to this moderate severity flaw.
Why it matters: Organizations running affected Artemis or ActiveMQ Artemis versions face exposure of internal cluster topology to unauthenticated network attackers, which could facilitate further reconnaissance or attacks; patching or upgrading to fixed versions is required.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-49363: Apache Artemis, Apache ActiveMQ Artemis: Pre-Authentication Information Disclosure in CORE Protocol Topology Subscription
CVE-2026-49363 is a pre-authentication information disclosure flaw in Apache Artemis and Apache ActiveMQ Artemis that allows remote attackers to extract cluster topology details via the CORE protocol before credentials are validated. The vulnerability affects Artemis versions 2.50.0 through 2.56.0 and ActiveMQ Artemis versions 1.0.0 through 2.44.0, with a CVSS score of 7.5.
Why it matters: Organizations running affected Artemis or ActiveMQ Artemis versions should patch immediately to prevent unauthenticated network reconnaissance that could enable follow-up attacks against message broker infrastructure.
- Source published
- First seen by Cybersecurity Tracker