Executive brief
Apache ActiveMQ is a popular open-source message broker used to facilitate communication between different software applications. A security vulnerability allows an authenticated user to bypass previous security fixes and execute unauthorized commands on the server. This could lead to a complete takeover of the message broker, potentially resulting in data theft, service disruption, or further attacks on the internal network.
Technical details
This vulnerability is a bypass of the fix for CVE-2026-34197. It occurs when an authenticated attacker adds a network connector using an HTTP Discovery transport via BrokerView.addNetworkConnector or BrokerView.addConnector through the Jolokia JMX-HTTP bridge. If the activemq-http module is on the classpath, a malicious HTTP endpoint can return a VM transport URI. This URI uses the 'brokerConfig' parameter to force the ResourceXmlApplicationContext to load a remote Spring XML application context. Because Spring instantiates singleton beans before the BrokerService validates the configuration, an attacker can achieve arbitrary code execution on the broker's JVM using bean factory methods like Runtime.exec(). The issue is resolved in versions 5.19.6 and 6.2.5.
Affected products
- Apache ActiveMQ Broker < 5.19.6, 6.0.0 to < 6.2.5
- Apache ActiveMQ All < 5.19.6, 6.0.0 to < 6.2.5
- Apache ActiveMQ < 5.19.6, 6.0.0 to < 6.2.5
Timeline
- 2026-04-24: disclosed
- 2026-04-24: advisory
References
- https://repo.maven.apache.org/maven2
- https://activemq.apache.org/security-advisories.data/CVE-2026-34197-announcement.txt
- https://access.redhat.com/security/cve/CVE-2026-40466
- https://bugzilla.redhat.com/show_bug.cgi?id=2461410
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40466.json