Executive brief
Apache ActiveMQ, a popular open-source message broker used for communication between different software applications, is vulnerable to a code injection flaw. An authenticated attacker can exploit this to run unauthorized commands on the server hosting the broker. This could lead to a full system takeover, data theft, or disruption of business operations.
Technical details
This vulnerability is a bypass of the fix for CVE-2026-34197. Apache ActiveMQ exposes the Jolokia JMX-HTTP bridge at /api/jolokia/, which by default allows execution operations on ActiveMQ MBeans. An authenticated attacker can use non-parenthesized discovery wrappers (e.g., 'masterslave:vm://' or 'static:vm://') to bypass input validation. By crafting a discovery URI that triggers the VM transport's brokerConfig parameter, an attacker can force the application to load a remote Spring XML application context. Because Spring instantiates singleton beans before the BrokerService validates the configuration, an attacker can achieve arbitrary code execution via bean factory methods like Runtime.exec(). The issue is resolved in versions 5.19.7 and 6.2.6.
Affected products
- Apache ActiveMQ Broker < 5.19.7, 6.0.0 to < 6.2.6
- Apache ActiveMQ All < 5.19.7, 6.0.0 to < 6.2.6
- Apache ActiveMQ < 5.19.7, 6.0.0 to < 6.2.6
Timeline
- 2026-06-01: advisory: Initial publication of the advisory
- 2026-07-09: other: Advisory updated and reviewed by GitHub