CVE-2026-49270

A flaw was found in Apache ActiveMQ. An unauthenticated attacker can exploit this vulnerability when brokers are configured with a network connector with syncDurableSubs set to true. By sending a BrokerInfo command, the attacker can receive a list of all durable topic subscriptions, including sensitive details like client identifiers, subscription names, topic destinations, and JMS selector expressions. This information disclosure is due to the broker incorrectly responding without first ensuring the connection is authenticated.

Red Hat products ship Apache ActiveMQ Classic components as transitive dependencies. The vulnerability allows unauthenticated information disclosure via BrokerInfo commands when the broker has a network connector with syncDurableSubs=true configured. This is a non-default configuration specific to Classic ActiveMQ broker-to-broker networking. Red Hat AMQ Broker is based on Apache ActiveMQ Artemis, which handles BrokerInfo commands through its own code and does not use Classic's network connector configuration. The vulnerable code path is not exercised in Red Hat product deployments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.