CVE-2026-57967: unauth Artemis CORE session steal and OpenWire queue delete

If your Artemis broker still speaks CORE or OpenWire to anything you do not fully trust, an unauthenticated caller can steal a live session, create durable queues, or delete queues before login. Apache shipped Artemis 2.57.0 on September 9, 2026 with seven security fixes. The ones that change your day are CVE-2026-57967 (CORE SESSION_REATTACH session steal), CVE-2026-67593 (OpenWire RemoveSubscriptionInfo queue delete before auth), and CVE-2026-49362 (unauthenticated CORE durable-queue create). The rest of the train is topology leak, network-adjacent cluster-credential exposure, and two authenticated DoS paths. One upgrade covers all of them.

This is the operator write-up. The HOL Guard evidence packs for CVE-2026-57967, CVE-2026-67593, and CVE-2026-49362 are the source records.

What breaks

Apache rated the three unauthenticated state-change bugs important. CVE-2026-57967: an unauthenticated remote attacker crafts a CORE SESSION_REATTACH packet and takes over an already-authenticated session. CVE-2026-49362: the same unauthenticated CORE path can create arbitrary durable queues (broker state churn / DoS). CVE-2026-67593: an OpenWire RemoveSubscriptionInfo command deletes a queue before the connection finishes authentication (or anytime after). CVE-2026-49364 is also important but narrower: a network-adjacent attacker on discovery can capture cluster administrative credentials during the initial handshake. CVE-2026-49363 (moderate) lets an unauthenticated CORE client read cluster topology via SUBSCRIBE_TOPOLOGY before auth. CVE-2026-57822 and CVE-2026-75880 are important/moderate DoS that need an already-authenticated client (57822 also needs MANAGE for management-via-messaging).

Affected trains from the Apache announce mails: Apache Artemis org.apache.artemis:artemis-server (and related modules) 2.50.0 through 2.56.0, and Apache ActiveMQ Artemis org.apache.activemq:artemis-* 1.0.0 through 2.44.0 (OpenWire jakarta module starts at 2.32.0; management-via-messaging client train starts at 1.3.0). Fix version for every ID in this cluster: 2.57.0. Java for 2.57.0 is 17+.

The OpenWire queue-delete fix landed in tree on 2026-08-10 ("Enforce auth checks for RemoveSubscriptionInfo and other openwire commands that arrive before the ConnectionInfo is received") and first shipped in the 2.57.0 binary on September 9. 2.56.0 (Aug 27) is still in the affected range.

Who is not in scope

Classic ActiveMQ 5.x (non-Artemis) is not this cluster. Brokers already on Artemis 2.57.0+ are patched. CVE-2026-57822 does not apply unless management-via-messaging is enabled for a client with MANAGE. CVE-2026-49364 needs network-adjacent discovery reachability, not just any internet CORE port. MQTT/AMQP-only acceptors with CORE and OpenWire removed from the acceptor URL are outside the unauthenticated CORE/OpenWire set (confirm the protocols list; an acceptor with no protocols parameter still defaults to all protocols, including CORE).

How to check

On the broker host:

./bin/artemis version
# or
java -cp lib/artemis-server-*.jar -version 2>/dev/null; ls lib/artemis-server-*.jar

Anything reporting 2.56.0 or older on the Artemis train (or 2.44.0 or older on the ActiveMQ Artemis train) needs 2.57.0. Then open broker.xml and inspect every <acceptor> URL: if protocols is absent, or includes CORE / OPENWIRE, treat those listeners as in scope for the unauthenticated bugs until you upgrade.

How to fix

Upgrade to Apache Artemis 2.57.0 (or a downstream build that includes those commits). That is the only fix Apache published for this train. Do not stop at disabling CORE if OpenWire is still on an untrusted acceptor. CVE-2026-67593 is an OpenWire pre-auth path; a CORE-only lockdown leaves queue delete open. After upgrade, re-check ./bin/artemis version and confirm acceptors that face untrusted networks either require mutual TLS or advertise only the protocols you intend.

What this is not

This is not remote code execution and not a claimed KEV / in-the-wild bulletin. Damage is session takeover, queue create/delete, credential exposure on discovery, and DoS. You still need a reachable CORE or OpenWire listener (or discovery adjacency for 49364) for the unauthenticated set.

References

• Apache Artemis security advisories (2.57.0 cluster)
• Artemis 2.57.0 download (Sep 9, 2026)
• CVE-2026-57967 announce
• CVE-2026-67593 announce
• CVE-2026-49362 announce
• HOL Guard pack CVE-2026-57967