Executive brief
Apache ActiveMQ is a popular open-source message broker used to facilitate communication between different software applications. A vulnerability exists where an attacker with the ability to modify directory service (LDAP) entries can force the message broker to connect to a malicious server. This could allow the attacker to run unauthorized services within the broker's environment, potentially leading to a complete compromise of the messaging infrastructure and the data it handles.
Technical details
An improper input validation vulnerability (CWE-20) exists in Apache ActiveMQ's LDAP integration. An attacker who can publish or modify LDAP entries matching the configured 'searchBase' and 'searchFilter' can bypass transport restrictions. By manipulating these entries, the attacker can force the broker JVM to fetch a remote URL and instantiate a second 'BrokerService' instance. This effectively allows for remote code execution or unauthorized service persistence within the same Java Virtual Machine. The issue is resolved in versions 5.19.8 and 6.2.7.
Affected products
- Apache Software Foundation Apache ActiveMQ Broker before 5.19.8, 6.0.0 to 6.2.6
- Apache Software Foundation Apache ActiveMQ before 5.19.8, 6.0.0 to 6.2.6
- Apache Software Foundation Apache ActiveMQ All before 5.19.8, 6.0.0 to 6.2.6
Timeline
- 2026-06-30: disclosed
- 2026-06-30: advisory
- 2026-06-30: patched