CVE-2026-52760

Overview

Apache ActiveMQ Classic is an open-source Java message broker that provides asynchronous messaging for applications. It supports JMS 1.1 and multiple wire protocols, including OpenWire, AMQP, MQTT and STOMP. Broker and client components are published as Maven artifacts under org.apache.activemq. ActiveMQ Classic is distinct from Apache ActiveMQ Artemis, which has its own broker implementation and release lines.

A cross-site scripting (XSS) vulnerability (CVE-2026-52760) has been identified in the Apache ActiveMQ Classic web console, which allows attackers to run HTML or JavaScript in an administrator's browser. An authenticated producer can send a message whose JMS message ID contains a script payload, and the payload executes when an administrator browses the queue in the web console.

Per OWASP: Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user.

This issue affects multiple versions of Apache ActiveMQ Classic.

‍

Details

Module Info

• Product: Apache ActiveMQ Classic
• Affected packages: org.apache.activemq:apache-activemq, org.apache.activemq:activemq-web-console
• Affected versions: <5.19.8, >=6.0.0 <6.2.7
• GitHub repository: https://github.com/apache/activemq
• Published packages:
  • https://central.sonatype.com/artifact/org.apache.activemq/apache-activemq
  • https://central.sonatype.com/artifact/org.apache.activemq/activemq-web-console
• Package manager: Maven
• Fixed in:
  • OSS Apache ActiveMQ Classic 5.19.8, 6.2.7
  • NES for ActiveMQ v5.16.12

Vulnerability Info

This Medium-severity vulnerability is found in the org.apache.activemq:activemq-web-console package, which is also bundled in the org.apache.activemq:apache-activemq distribution, in multiple versions of Apache ActiveMQ Classic. The web console's queue browse page, browse.jsp, lists each message in a queue and links it to its detail page. Most columns are written through the JSTL <c:out> tag, which escapes HTML, but the link text for the JMS message ID is written with a raw EL expression:

<td><a href="<c:url value="message.jsp">
                 <c:param name="id" value="${row.JMSMessageID}" />
                 <c:param name="JMSDestination" value="${requestContext.queueBrowser.JMSDestination}"/></c:url>"
    title="<c:out value="${row.properties}"/>">${row.JMSMessageID}</a></td>

The JMS message ID can be set by the producer that sends the message. A user who is allowed to send messages to a queue can therefore set an ID containing HTML or JavaScript, and it is stored with the message on the broker. When an administrator later opens the queue in the web console, the ID is written into the page unescaped and the script runs in the administrator's browser with the privileges of their web console session.

The queue consumers page, queueConsumers.jsp, has the same pattern for network consumers, where the client ID is written into the page without escaping:

<c:when test="${row.network}">
    <a href="network.jsp">${row.clientId}</a><br/>
</c:when>

‍

Mitigation

Inactive versions of Apache ActiveMQ Classic are End-of-Life and will not receive updates to address this issue. For more information, see here.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to a currently supported release of Apache ActiveMQ Classic that contains the fix.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

‍

Credits

• Biswajeet Ray (finder)