Bug 2492627 (CVE-2026-49363)

Summary:	CVE-2026-49363 artemis-server: artemis-server: Pre-auth topology disclosure via CORE SUBSCRIBE_TOPOLOGY_V2 on channel0
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	anujha, asoldano, ataylor, bbaranow, bmaxwell, bstansbe, dbruscin, dlofthou, ehugonne, fmariani, gmalinko, istudens, ivassile, iweiss, janstey, jwon, kvanderr, mcarlett, mosmerov, msvehla, nwallace, pberan, pdelbell, pesilva, pjindal, pmackay, rstancel, rstepani, security-response-team, tcunning, thjenkin, vdosoudi, yfang
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A missing authentication vulnerability was found in Apache ActiveMQ Artemis. The SUBSCRIBE_TOPOLOGY_V2 handler in CoreProtocolManager.LocalChannelHandler.handlePacket() processes topology subscription requests on channel0 with zero authentication -- no call to getSecurityStore(), no credential verification, no subject validation. An unauthenticated attacker can send a single 5-byte packet on the CORE protocol (via :8080 HTTP-upgrade in EAP or :61616 in AMQ Broker) to obtain the broker's nodeID (type-1 UUID embedding MAC address), internal hostname/IP, port numbers, connector configurations, and backup/scale-down group names. In clustered deployments, a persistent ClusterTopologyListener is registered that continuously pushes all topology changes to the unauthenticated client. This contrasts with the federation handler in the same file which was fixed via ARTEMIS-5928 (CVE-2026-27446). The leaked nodeID UUID seed directly enables session-name brute-force for REATTACH_SESSION session hijack.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-06-25 04:37:29 UTC

Pre-auth topology disclosure via Artemis CORE SUBSCRIBE_TOPOLOGY_V2 on channel0. CoreProtocolManager.LocalChannelHandler.handlePacket() processes topology subscriptions with zero authentication -- no getSecurityStore(), no subject validation. Contrasts with federation handler fixed via ARTEMIS-5928 (CVE-2026-27446).

Vulnerable class: org.apache.activemq.artemis.core.protocol.core.impl.CoreProtocolManager
- https://github.com/apache/activemq-artemis/blob/2.16.0/artemis-server/src/main/java/org/apache/activemq/artemis/core/protocol/core/impl/CoreProtocolManager.java
- https://github.com/apache/activemq-artemis/blob/2.52.0/artemis-server/src/main/java/org/apache/activemq/artemis/core/protocol/core/impl/CoreProtocolManager.java

Affected: All Artemis versions (2.16.0 through 2.52.0 and main)
Fixed: No upstream fix available

Related (different issue): CVE-2026-27446 (federation handler auth bypass only, fixed via ARTEMIS-5928)

Comment 1 errata-xmlrpc 2026-09-10 16:36:49 UTC

This issue has been addressed in the following products:

  Red Hat AMQ Broker 7.14.1

Via RHSA-2026:66488 https://access.redhat.com/errata/RHSA-2026:66488

Comment 2 errata-xmlrpc 2026-09-10 23:24:48 UTC

This issue has been addressed in the following products:

  Red Hat AMQ Broker 7.13.6

Via RHSA-2026:66545 https://access.redhat.com/errata/RHSA-2026:66545

Comment 3 Jon Orris 2026-09-22 12:56:56 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8

Via RHSA-2026:70228 https://access.redhat.com/errata/RHSA-2026:70228

Comment 4 Jon Orris 2026-09-22 12:59:23 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10

Via RHSA-2026:70230 https://access.redhat.com/errata/RHSA-2026:70230

Comment 5 Jon Orris 2026-09-22 13:01:31 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9

Via RHSA-2026:70229 https://access.redhat.com/errata/RHSA-2026:70229

Comment 6 Jon Orris 2026-09-22 15:36:32 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 8.1

Via RHSA-2026:70277 https://access.redhat.com/errata/RHSA-2026:70277