A vulnerability in Apache Artemis allows unauthenticated remote attackers to perform unauthorized information disclosure regarding cluster topology.

The flaw is a missing authentication check (CWE-306) for the SUBSCRIBE_TOPOLOGY function within the CORE protocol, which allows unauthenticated remote attackers to retrieve sensitive cluster node details.

Successful exploitation of this vulnerability permits unauthorized access to internal infrastructure details, which can be leveraged for reconnaissance and targeted follow up attacks against the messaging cluster. While the CVSS score of 7.5 reflects a high severity rating due to the ease of exploitation, the impact is primarily focused on the confidentiality of network configuration rather than total system compromise.

Immediate Action: Upgrade to Apache Artemis version 2.57.0, which contains the necessary security patch to enforce authentication requirements.

Proactive Monitoring: Review application and network logs for unauthorized or unexpected SUBSCRIBE_TOPOLOGY requests originating from untrusted sources.

Compensating Controls: Implement network segmentation or access control lists to restrict access to the Artemis CORE protocol port to authorized management hosts only.

Public Exploit Available: No

This vulnerability presents a significant reconnaissance risk to messaging environments. Administrators must prioritize upgrading affected instances to version 2.57.0 immediately to prevent unauthorized exposure of cluster architecture, which could otherwise facilitate more severe lateral movement or targeted attacks.