Executive brief
Apache ActiveMQ, a popular open-source message broker used for communication between different software applications, contains a vulnerability in its management console. An authenticated user can exploit a management interface to run unauthorized commands on the server. This could allow an attacker to take full control of the message broker, potentially leading to the theft of sensitive business data or disruption of message delivery services.
Technical details
Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ with a default policy that allows 'exec' operations on ActiveMQ MBeans. An authenticated attacker can invoke 'BrokerService.addNetworkConnector' using a crafted 'masterslave://' discovery URI. This URI triggers the VM transport's 'brokerConfig' parameter, which utilizes Spring's 'ResourceXmlApplicationContext' to load a remote XML configuration. Because Spring instantiates singleton beans before the broker validates the configuration, an attacker can achieve arbitrary code execution via bean factory methods (e.g., Runtime.exec). The vulnerability is patched in versions 5.19.7 and 6.2.6.
Affected products
- Apache ActiveMQ Broker < 5.19.7, >= 6.0.0 < 6.2.6
- Apache ActiveMQ All < 5.19.7, >= 6.0.0 < 6.2.6
- Apache ActiveMQ < 5.19.7, >= 6.0.0 < 6.2.6
Timeline
- 2026-05-31: disclosed: Initial disclosure on oss-security mailing list
- 2026-06-01: advisory: GitHub and NVD advisories published
- 2026-07-09: other: Advisory reviewed and updated