Description

A remote attacker can craft an Openwire RemoveSubscriptionInfo command to cause the deletion of a queue on the Artemis broker before the connection authentication and authorization stage or at any time thereafter. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0. Users are recommended to upgrade to version 2.57.0, which fixes the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-09-10T05:17:01.560Z",
  "pubdate": "2026-09-10T05:17:01.560Z",
  "executiveSummary": "This vulnerability involves an improper authorization check within the Openwire protocol implementation of Apache ActiveMQ Artemis. It allows a remote, unauthenticated attacker to execute a specific Openwire command to perform unauthorized administrative actions, specifically the deletion of queues.\nThe vulnerability affects Apache Artemis versions 2.50.0 through 2.56.0 and Apache ActiveMQ Artemis versions 1.0.0 through 2.44.0.\nThe primary risk is a Denial of Service (DoS) resulting from the forced removal of queues, which disrupts message routing, persistence, and overall broker availability. Because the command can be issued prior to the completion of the authentication and authorization handshake, the exploit bypasses existing security constraints. Successful exploitation requires no prior authentication, exposing the broker to any entity with network access to the Openwire port. Organizations should prioritize upgrading to version 2.57.0 to implement the necessary security checks and prevent unauthorized resource management.",
  "technicalDetails": "The vulnerability resides in the Openwire protocol handling logic within the Apache ActiveMQ Artemis broker. The Openwire protocol is a feature-rich, binary wire protocol that includes commands for client-side subscription management. A flaw in the state machine or message processing pipeline allows for the processing of a specific command, 'RemoveSubscriptionInfo', without ensuring the associated session or connection has successfully passed through the required authentication and authorization filters.\nThe attack flow begins with the attacker establishing a TCP connection to the port configured for Openwire communication. Before completing the standard handshake or authentication sequence, the attacker sends a crafted 'RemoveSubscriptionInfo' Openwire command. The broker's internal protocol processor receives this command and fails to validate the current session's authorization state. Consequently, the broker executes the request, which invokes internal methods responsible for managing subscription state and, by extension, the underlying queue structures.\nBy manipulating this command, an attacker can target specific queues managed by the broker. When the 'RemoveSubscriptionInfo' command is processed incorrectly, the broker executes the deletion logic associated with the queue identified in the payload. This bypasses the typical security architecture, which assumes that administrative or resource-modifying commands are only available to authenticated clients with appropriate permissions.\nThe technical root cause is a failure in the protocol's command dispatching logic. The dispatch mechanism does not enforce an 'is-authenticated' check on the connection object before handing off the 'RemoveSubscriptionInfo' command to the subscription manager. Because this check is bypassed, the command execution occurs with an implicit privilege level that permits administrative operations, even though the session context is effectively anonymous.\nThe impact is significant: an attacker can selectively delete queues, leading to a complete disruption of message flow, loss of undelivered messages contained within those queues, and a persistent Denial of Service for applications relying on the deleted infrastructure. Furthermore, because this can be performed at any time, an attacker could repeatedly target the broker, effectively preventing any stable operation of the message distribution environment."
}