CVE-2026-34197

Overview

Apache ActiveMQ Classic is a popular open-source message broker and Enterprise Integration Patterns server. It supports JMS 1.1 and a range of wire protocols, including OpenWire, STOMP, AMQP and MQTT, and offers pluggable transports such as in-VM, TCP, SSL and NIO. It ships a web console that exposes broker management over the Jolokia JMX-HTTP bridge. Broker and client components are published as Maven artifacts under org.apache.activemq.

A remote code execution vulnerability (CVE-2026-34197) has been identified in the ActiveMQ broker's BrokerView management MBean, which allows authenticated attackers to execute arbitrary code on the broker's JVM. An attacker who can reach the Jolokia endpoint of the web console can add a connector whose VM transport URI loads a remote Spring XML application context. CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog.

Per OWASP: Code Injection is the general term for attack types which consist of injecting code that is then interpreted/executed by the application. This type of attack exploits poor handling of untrusted data.

This issue affects multiple versions of ActiveMQ.

Details

Module Info

• Product: ActiveMQ
• Affected packages: org.apache.activemq:activemq-broker, org.apache.activemq:activemq-all, org.apache.activemq:apache-activemq
• Affected versions: <5.19.4, >=6.0.0 <6.2.3
• GitHub repository: https://github.com/apache/activemq
• Published packages: https://central.sonatype.com/artifact/org.apache.activemq/activemq-broker, https://central.sonatype.com/artifact/org.apache.activemq/activemq-all, https://central.sonatype.com/artifact/org.apache.activemq/apache-activemq
• Package manager: Maven
• Fixed in:
  • OSS ActiveMQ 5.19.4, 6.2.3
  • NES for ActiveMQ v5.16.10

Vulnerability Info

This High-severity vulnerability is found in the org.apache.activemq:activemq-broker package in multiple versions of ActiveMQ. The web console exposes the Jolokia JMX-HTTP bridge at /api/jolokia/, and the default Jolokia access policy permits exec operations on every ActiveMQ MBean (org.apache.activemq:*). That includes the broker MBean's addConnector(String) and addNetworkConnector(String) operations, which BrokerView implements by passing the caller's URI straight to the BrokerService without checking its transport scheme:

@Override
public String addConnector(String discoveryAddress) throws Exception {
    TransportConnector connector = brokerService.addConnector(discoveryAddress);
    if (connector == null) {
        throw new NoSuchElementException("Not connector matched the given name: " + discoveryAddress);
    }
    brokerService.startTransportConnector(connector);
    return connector.getName();
}

@Override
public String addNetworkConnector(String discoveryAddress) throws Exception {
    NetworkConnector connector = brokerService.addNetworkConnector(discoveryAddress);
    if (connector == null) {
        throw new NoSuchElementException("Not connector matched the given name: " + discoveryAddress);
    }
    brokerService.registerNetworkConnectorMBean(connector);
    connector.start();
    return connector.getName();
}

An authenticated user can therefore supply a vm:// URI, either directly or as a component of a composite discovery URI. The VM transport honours a brokerConfig query parameter and uses it as the URI of the configuration for the embedded broker it creates:

host = extractHost(location);
options = URISupport.parseParameters(location);
String config = options.remove("brokerConfig");
if (config != null) {
    brokerURI = new URI(config);
}

When brokerConfig points at an attacker-hosted Spring XML file, the broker loads it with ResourceXmlApplicationContext. Spring instantiates every singleton bean in that context before the BrokerService validates the configuration, so bean definitions that call factory methods such as Runtime.exec() run arbitrary commands on the broker's JVM with the broker's privileges.

Mitigation

Only recent versions of ActiveMQ are community-supported. Older lines are End-of-Life and will not receive public updates to address this issue. For more information see here.

Users of the affected components should apply one of the following mitigations:

• Upgrade ActiveMQ to a currently supported release that contains the fix.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• Naveen Sunkavally from Horizon3.ai (finder)