CVE-2026-67593: Apache ActiveMQ Artemis Unauthenticated Queue Deletion

Overview

CVE-2026-67593 allows a remote, unauthenticated attacker to delete queues on an Apache ActiveMQ Artemis broker by crafting an OpenWire RemoveSubscriptionInfo command. The command is processed before the connection completes authentication and authorization — and can also be replayed at any later point in the connection's lifecycle — making the flaw a straightforward, pre-auth path to destructive denial of service against messaging infrastructure.

Technical Details

How It Works

Artemis brokers that expose the OpenWire protocol process certain connection-management commands, including RemoveSubscriptionInfo, prior to completing the authentication handshake for the connection. In affected versions, this command is accepted and acted upon regardless of authentication state — allowing an attacker to send a crafted RemoveSubscriptionInfo packet that causes the broker to delete a targeted queue.

Because the command is honored both pre-authentication and at any point thereafter, even brokers that later enforce strict authentication on message operations remain exposed to this specific control-plane command.

Impact Assessment

Who Is At Risk

• Any Artemis broker with an OpenWire listener reachable from untrusted or insufficiently restricted networks
• Production messaging pipelines where queue availability is critical to application function (order processing, event-driven microservices, IoT telemetry ingestion)
• Deployments assuming that pre-authentication network exposure carries no risk of state-changing actions

Potential Attack Chains

1. Unauthenticated Connection — Attacker opens a raw OpenWire connection to the broker without valid credentials.
2. Crafted Deletion Command — Attacker sends a RemoveSubscriptionInfo packet targeting a known or guessed queue/subscription.
3. Queue Loss — The broker deletes the targeted queue, dropping in-flight and durable messages tied to it.
4. Denial of Service — Dependent applications lose messaging connectivity, causing cascading failures across queue-dependent services.

Data Loss Considerations

Deleting a queue can result in permanent loss of durable messages that had not yet been consumed, with no built-in recovery path beyond broker-level backups or message replay from an upstream source, if one exists.

Mitigation

Immediate Actions

• Upgrade to Apache Artemis 2.57.0, which enforces authentication before honoring RemoveSubscriptionInfo and similar control commands.
• Restrict OpenWire listener exposure to trusted internal networks only — do not expose broker protocol ports directly to the internet.
• Audit for recently deleted queues/subscriptions that cannot be attributed to known administrative activity.

Detection Opportunities

• Monitor broker logs for RemoveSubscriptionInfo commands issued on unauthenticated or newly established connections.
• Alert on unexpected queue or durable subscription deletions outside of change-managed maintenance windows.
• Watch for connection attempts to OpenWire ports from IP ranges outside your known application/client inventory.

Defence-in-Depth

• Segment broker networks so only authorized application servers can reach OpenWire, AMQP, or CORE protocol ports.
• Enable broker-level backups or mirrored queues so accidental or malicious deletion does not result in permanent message loss.
• Disable unused protocol acceptors (e.g., OpenWire) on brokers that don't require them, reducing overall attack surface.

Background

This is the third of three related Apache Artemis vulnerabilities disclosed together and fixed in version 2.57.0, alongside CVE-2026-49364 (cluster credential exposure) and CVE-2026-57967 (session hijack). All three stem from control-plane commands being processed without adequate authentication checks, and organizations running any affected Artemis or legacy ActiveMQ Artemis version should treat the 2.57.0 upgrade as a single, urgent remediation.

References

• NVD — CVE-2026-67593
• Apache Artemis Security Advisories