Medium [CVE-2026-49363] Pre-auth topology disclosure via CORE SUBSCRIBE_TOPOLOGY_V2 on channel0
This medium-severity Red Hat Linux advisory covers CVE-2026-49363 affecting Red Hat AMQ Broker 7, Red Hat JBoss Enterprise Application Platform 7, Red Hat JBoss Enterprise Application Platform 8.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
A missing authentication vulnerability was found in Apache ActiveMQ Artemis. The SUBSCRIBE_TOPOLOGY_V2 handler in CoreProtocolManager.
LocalChannelHandler.handlePacket() processes topology subscription requests on channel0 with zero authentication -- no call to getSecurityStore(), no credential verification, no subject validation.
An unauthenticated attacker can send a single 5-byte packet on the CORE protocol (via:8080 HTTP-upgrade in EAP or:61616 in AMQ Broker) to obtain the broker's nodeID (type-1 UUID embedding MAC address), internal hostname/IP, port numbers, connector configurations, and backup/scale-down group names.
In clustered deployments, a persistent ClusterTopologyListener is registered that continuously pushes all topology changes to the unauthenticated client. This contrasts with the federation handler in the same file which was fixed via ARTEMIS-5928 (CVE-2026-27446).
The leaked nodeID UUID seed directly enables session-name brute-force for REATTACH_SESSION session hijack. Red Hat severity: Moderate — CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
Weakness: CWE-306. Affected Red Hat products: Red Hat AMQ Broker 7; Red Hat JBoss Enterprise Application Platform 7; Red Hat JBoss Enterprise Application Platform 8; Red Hat JBoss Enterprise Application Platform Expansion Pack.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · high-confidence parse· fetched 1 hour ago·verify at source
Fixed versions
No fixed release is recorded yet. That does not prove no patch exists — confirm against the vendor advisory.
Official advisory · high-confidence parse· fetched 1 hour ago·verify at source
Mitigation checklist
- 1. Remove Core protocol from internet-facing acceptors -- configure the protocols parameter to exclude Core protocol on any acceptor receiving untrusted connections. In EAP, the :8080 HTTP-upgrade acceptor supports Core by default; restricting to AMQP/STOMP/OpenWire prevents the attack entirely. 2. Enable mutual TLS -- configure sslEnabled=true with needClientAuth=true on all Core protocol acceptors. TLS handshake failure occurs before any protocol-level packet can be sent. 3. Disable HTTP-upgrade for Core protocol if not required -- remove the http-upgrade element from the Artemis acceptor configuration to eliminate the :8080 attack surface.
Official advisory · high-confidence parse· fetched 1 hour ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.