CVE-2026-49270: Apache ActiveMQ Durable Subscription Metadata Disclosure

Technical summary

CVE-2026-49270 is an information disclosure vulnerability in Apache ActiveMQ where brokers configured with syncDurableSubs=true in network connector settings fail to enforce authentication checks before responding to BrokerInfo commands. An unauthenticated remote attacker can exploit this to enumerate all durable topic subscriptions and associated metadata. The vulnerability affects ActiveMQ versions before 5.19.7 and 6.0.0 through 6.2.5. The root cause is improper access control at the protocol handler level—the broker should validate peer authentication before exposing subscription metadata, regardless of network topology.

Business impact

Durable subscription metadata exposes business logic and client topology. Subscription names, JMS selectors, and destination mappings often encode application architecture and data flow patterns. Competitors or malicious actors could map your event-driven infrastructure, identify high-value data streams, or craft targeted attacks on known subscribers. For compliance-sensitive organizations (finance, healthcare), disclosure of subscription details tied to client identifiers may trigger data protection incidents. The impact is primarily confidentiality; no data corruption or denial of service occurs.

Affected systems

Affected versions: Apache ActiveMQ (all products) before 5.19.7, and 6.0.0 through 6.2.5. The vulnerability is present only on brokers where a network connector is explicitly configured with syncDurableSubs=true. Brokers without network connectors, or with syncDurableSubs=false (the default), are not vulnerable. Check your broker configuration files (activemq.xml) for network connector definitions with this setting enabled.

Exploitability

Exploitability is moderate. The attack requires network access to the broker's OpenWire protocol port (default 61616) and knowledge that syncDurableSubs is enabled, but no authentication credentials. The CVSS score of 5.9 reflects high confidentiality impact offset by higher complexity (AC:H) due to configuration preconditions. No user interaction is needed, and the attack is reliable once the precondition is met. Public exploits are not yet known to be weaponized, but the simplicity of sending a crafted BrokerInfo command means exploitation barriers are low.

Remediation

Upgrade ActiveMQ to version 5.19.7 or 6.2.6 or later, which enforce authentication validation before exposing subscription metadata. If immediate patching is not feasible, disable syncDurableSubs on network connectors, or restrict network connector listening to trusted internal networks only. Review broker logs and network flow for unauthenticated BrokerInfo commands from suspicious sources.

Patch guidance

Apply the fix by upgrading to Apache ActiveMQ 5.19.7 (for the 5.x line) or 6.2.6 (for the 6.x line) or newer. Verify the patch by checking the version string post-upgrade. Test in a staging environment to confirm broker connectivity and durable subscription functionality remain intact. No configuration changes are required after patching; the authentication check is applied transparently.

Detection guidance

Monitor for unauthenticated BrokerInfo commands on the OpenWire port (61616 by default). Enable debug-level logging in ActiveMQ and search for BrokerInfo messages from unknown peers or repeated enumeration attempts. Network IDS rules should flag multiple BrokerInfo requests from a single source that do not authenticate. Check broker configuration to identify which systems have syncDurableSubs=true and assess whether they are exposed to untrusted networks.

Why prioritize this

This vulnerability merits prompt attention despite a medium CVSS score because (1) durable subscription metadata is a valuable reconnaissance target for attackers planning supply-chain or infrastructure attacks, (2) the configuration condition is often overlooked, making it likely present in many deployments, and (3) the fix is straightforward and low-risk. Organizations running event-driven or message-intensive applications should prioritize remediation.

Risk score, explained

The CVSS 3.1 score of 5.9 (MEDIUM) reflects: Attack Vector=Network (full remote reach), Attack Complexity=High (requires syncDurableSubs configuration), Privileges Required=None (unauthenticated), User Interaction=None (automated attack), Scope=Unchanged, Confidentiality Impact=High (full subscription metadata leaked), Integrity Impact=None, Availability Impact=None. The high complexity penalty applies because the vulnerability depends on a specific, non-default configuration choice. In practice, organizations where this setting is enabled should treat the risk as elevated relative to the base CVSS.

Frequently asked questions