CVE-2026-41043

Overview

Apache ActiveMQ is a popular and powerful open-source messaging and Integration Patterns server. ActiveMQ Classic is a Java message broker that supports JMS along with protocols such as OpenWire, AMQP, STOMP and MQTT, and ships a web console for managing and browsing broker destinations. Broker, client and web components are published as Maven artifacts under org.apache.activemq.

A cross-site scripting (XSS) vulnerability (CVE-2026-41043) has been identified in the queue browse servlet of the ActiveMQ web console, which allows authenticated attackers to make the console return attacker-controlled HTML by overriding the response content type and injecting markup into the JMS selector. A user who opens a crafted queue browse link can have script executed in the context of the web console.

Per OWASP: Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites.

This issue affects multiple versions of ActiveMQ.

‍

Details

Module Info

• Product: ActiveMQ
• Affected packages: org.apache.activemq:activemq-web, org.apache.activemq:apache-activemq
• Affected versions: <5.19.6, >=6.0.0 <6.2.5
• GitHub repository: https://github.com/apache/activemq
• Published packages: https://central.sonatype.com/artifact/org.apache.activemq/activemq-web, https://central.sonatype.com/artifact/org.apache.activemq/apache-activemq
• Package manager: Maven
• Fixed in:
  • OSS ActiveMQ 5.19.6, 6.2.5
  • NES for ActiveMQ v5.16.10

Vulnerability Info

This Medium-severity vulnerability is found in the org.apache.activemq:activemq-web package in multiple versions of ActiveMQ. The web console maps QueueBrowseServlet to /queueBrowse/*. When a request has no msgId parameter, the servlet picks a message renderer from the view parameter and then copies every request parameter onto that renderer through reflection:

protected void configureRenderer(HttpServletRequest request, MessageRenderer renderer) {
    Map<String, String> properties = new HashMap<String, String>();
    for (Enumeration<String> iter = request.getParameterNames(); iter.hasMoreElements();) {
        String name = (String) iter.nextElement();
        properties.put(name, request.getParameter(name));
    }
    IntrospectionSupport.setProperties(renderer, properties);
}

The default SimpleMessageRenderer exposes its response content type as a writable bean property, so a contentType request parameter replaces the intended text/xml value (the RSS renderer exposes entryContentType the same way). The renderer then writes the queue name, the JMS selector taken from the selector request parameter, and each message ID straight into the response without any escaping:

private String contentType = "text/xml";

public void setContentType(String contentType) {
    this.contentType = contentType;
}

protected void printHeader(PrintWriter writer, QueueBrowser browser, HttpServletRequest request) throws IOException, JMSException, ServletException {
    writer.println("");
    writer.print("<messages queue='");
    writer.print(browser.getQueue());
    writer.print("'");
    String selector = browser.getMessageSelector();
    if (selector != null) {
        writer.print(" selector='");
        writer.print(selector);
        writer.print("'");
    }
    writer.println(">");
}

An authenticated attacker can therefore build a queue browse URL that sets contentType=text/html and supplies a syntactically valid selector whose string literal contains HTML, for example a <script> element. The broker accepts the selector, the servlet sends it back verbatim, and the browser renders the response as HTML on the web console's origin, executing the injected script for whoever opens the link.

‍

Mitigation

Only recent versions of Apache ActiveMQ are community-supported. Older lines are End-of-Life and will not receive public updates to address this issue. For more information see here.

Users of the affected components should apply one of the following mitigations:

• Upgrade ActiveMQ to a currently supported release that contains the fix.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

‍

Credits

• Khaled Alshammri (finder)