{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-67593", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-07-29T21:00:39.551Z", "datePublished": "2026-09-10T04:40:29.793Z", "dateUpdated": "2026-09-10T15:51:10.430Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-09-10T04:40:29.793Z"}, "title": "Apache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-authentication Openwire protocol handling can result in queue deletion", "problemTypes": [{"descriptions": [{"description": "CWE-306 Missing Authentication for Critical Function", "lang": "en", "cweId": "CWE-306", "type": "CWE"}]}], "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Artemis", "collectionURL": "https://repo.maven.apache.org/maven2", "packageName": "org.apache.artemis:artemis-openwire-protocol", "packageURL": "pkg:maven/org.apache.artemis/artemis-openwire-protocol", "versions": [{"status": "affected", "version": "2.50.0", "lessThanOrEqual": "2.56.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Apache Software Foundation", "product": "Apache Artemis", "collectionURL": "https://repo.maven.apache.org/maven2", "packageName": "org.apache.artemis:artemis-jakarta-openwire-protocol", "packageURL": "pkg:maven/org.apache.artemis/artemis-jakarta-openwire-protocol", "versions": [{"status": "affected", "version": "2.50.0", "lessThanOrEqual": "2.56.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Apache Software Foundation", "product": "Apache ActiveMQ Artemis", "collectionURL": "https://repo.maven.apache.org/maven2", "packageName": "org.apache.activemq:artemis-openwire-protocol", "packageURL": "pkg:maven/org.apache.activemq/artemis-openwire-protocol", "versions": [{"status": "affected", "version": "1.0.0", "lessThanOrEqual": "2.44.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Apache Software Foundation", "product": "Apache ActiveMQ Artemis", "collectionURL": "https://repo.maven.apache.org/maven2", "packageName": "org.apache.activemq:artemis-jakarta-openwire-protocol", "packageURL": "pkg:maven/org.apache.activemq/artemis-jakarta-openwire-protocol", "versions": [{"status": "affected", "version": "2.32.0", "lessThanOrEqual": "2.44.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"value": "A remote attacker can craft an Openwire RemoveSubscriptionInfo command to cause the deletion of a queue on the Artemis broker before the connection authentication and authorization stage or at any time thereafter. \n\n\n\nThis issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0.\n\n\n\nUsers are recommended to upgrade to version 2.57.0, which fixes the issue.", "lang": "en", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>A remote attacker can craft an Openwire RemoveSubscriptionInfo command to cause the deletion of a queue on the Artemis broker before the connection authentication and authorization stage or at any time thereafter. </p><p>This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0.</p><p>Users are recommended to upgrade to version 2.57.0, which fixes the issue.</p>"}]}], "references": [{"url": "https://lists.apache.org/thread/zlglnsg8s5xv8n56d15dm5mf00h2d8xs", "tags": ["vendor-advisory"]}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "important"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "credits": [{"lang": "en", "value": "Daniel Birtwhistle", "type": "finder"}, {"lang": "en", "value": "krsecurity(kongr)", "type": "reporter"}, {"lang": "en", "value": "Dilrevx, NSSL, SJTU", "type": "reporter"}], "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/09/10/6"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-09-10T05:11:59.078Z"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-09-10T15:50:42.737088Z", "id": "CVE-2026-67593", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-10T15:51:10.430Z"}}]}}

{}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "org.apache.artemis:artemis-openwire-protocol", "packageURL": "pkg:maven/org.apache.artemis/artemis-openwire-protocol", "product": "Apache Artemis", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "2.56.0", "status": "affected", "version": "2.50.0", "versionType": "semver"}]}, {"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "org.apache.artemis:artemis-jakarta-openwire-protocol", "packageURL": "pkg:maven/org.apache.artemis/artemis-jakarta-openwire-protocol", "product": "Apache Artemis", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "2.56.0", "status": "affected", "version": "2.50.0", "versionType": "semver"}]}, {"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "org.apache.activemq:artemis-openwire-protocol", "packageURL": "pkg:maven/org.apache.activemq/artemis-openwire-protocol", "product": "Apache ActiveMQ Artemis", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "2.44.0", "status": "affected", "version": "1.0.0", "versionType": "semver"}]}, {"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "org.apache.activemq:artemis-jakarta-openwire-protocol", "packageURL": "pkg:maven/org.apache.activemq/artemis-jakarta-openwire-protocol", "product": "Apache ActiveMQ Artemis", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "2.44.0", "status": "affected", "version": "2.32.0", "versionType": "semver"}]}], "source": "[email protected]"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A remote attacker can craft an Openwire RemoveSubscriptionInfo command to cause the deletion of a queue on the Artemis broker before the connection authentication and authorization stage or at any time thereafter. \n\n\n\nThis issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0.\n\n\n\nUsers are recommended to upgrade to version 2.57.0, which fixes the issue."}], "id": "CVE-2026-67593", "lastModified": "2026-09-10T16:17:45.273", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-67593", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-10T15:50:42.737088Z", "version": "2.0.3"}}]}, "published": "2026-09-10T05:17:01.560", "references": [{"source": "[email protected]", "url": "https://lists.apache.org/thread/zlglnsg8s5xv8n56d15dm5mf00h2d8xs"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/09/10/6"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-306"}], "source": "[email protected]", "type": "Secondary"}]}

{"bugzilla": {"description": "artemis-openwire-protocol: AMQ Broker Artemis: pre-authentication arbitrary durable queue deletion via OpenWire RemoveSubscriptionInfo", "id": "2510277", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510277"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.2", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "status": "draft"}, "cwe": "CWE-306", "details": ["An unauthenticated network attacker can delete arbitrary durable queues on any Apache Artemis broker with OpenWire protocol enabled (default). The processRemoveSubscription() method executes pre-authentication with no authorization check, and uses the internal destroyQueue(SimpleString) overload that skips security entirely. Default queues DLQ and ExpiryQueue are trivially targetable. This is unfixed in all Artemis versions through 2.55.0."], "mitigation": {"lang": "en:us", "value": "1. Remove OpenWire from acceptors \u2014 edit broker.xml, remove OPENWIRE from protocols parameter\n2. Firewall \u2014 restrict port 61616 to trusted clients if OpenWire cannot be disabled\n3. Monitor \u2014 watch for \"AMQ601069: destroyed queue: <name>\" in broker logs"}, "name": "CVE-2026-67593", "package_state": [{"cpe": "cpe:/a:redhat:amq_broker:7", "fix_state": "Affected", "package_name": "artemis-openwire-protocol", "product_name": "Red Hat AMQ Broker 7"}, {"cpe": "cpe:/a:redhat:camel_spring_boot:4", "fix_state": "Not affected", "package_name": "artemis-openwire-protocol", "product_name": "Red Hat build of Apache Camel for Spring Boot 4"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7", "fix_state": "Not affected", "package_name": "artemis-openwire-protocol", "product_name": "Red Hat JBoss Enterprise Application Platform 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8", "fix_state": "Not affected", "package_name": "artemis-openwire-protocol", "product_name": "Red Hat JBoss Enterprise Application Platform 8"}, {"cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Affected", "package_name": "artemis-openwire-protocol", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"}], "public_date": "2026-09-10T05:32:43Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-67593\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-67593"], "threat_severity": "Important"}

{"created": "2026-09-10T06:30:05.253028+00:00", "updated": "2026-09-10T13:30:12.654719+00:00", "vendors": []}