Executive Summary

CVE-2026-34197 is a code injection vulnerability in Apache ActiveMQ Broker and Apache ActiveMQ. It arises from improper input validation and improper control of code generation in the Jolokia JMX-HTTP bridge exposed at the /api/jolokia/ endpoint on the web console.

The default Jolokia access policy permits execution of operations on all ActiveMQ MBeans, including sensitive methods like BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String).

An authenticated attacker can exploit this by invoking these operations with a crafted discovery URI that leverages the VM transport's brokerConfig parameter to load a remote Spring XML application context using Spring’s ResourceXmlApplicationContext.

Because Spring instantiates all singleton beans before the BrokerService validates the configuration, this allows arbitrary code execution on the broker's JVM through bean factory methods such as Runtime.exec().

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an authenticated attacker to execute arbitrary code on the Apache ActiveMQ broker's JVM remotely.

Such arbitrary code execution can lead to full compromise of the broker, potentially allowing the attacker to manipulate messaging services, disrupt operations, steal sensitive data, or use the broker as a pivot point for further attacks within the network.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if your Apache ActiveMQ Broker or Apache ActiveMQ instance exposes the Jolokia JMX-HTTP bridge at the /api/jolokia/ endpoint on the web console.

Specifically, you should verify if the Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including sensitive methods like BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String).

Detection commands could include using curl or similar HTTP clients to query the Jolokia endpoint and check for accessible exec operations. For example:

• curl -u <username>:<password> http://<activemq-host>:<port>/api/jolokia/ -d '{"type":"exec","mbean":"org.apache.activemq:type=Broker,brokerName=localhost","operation":"addNetworkConnector","arguments":["someURI"]}'

If the above command succeeds or returns a response indicating the operation is permitted, the system is vulnerable.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate and recommended mitigation step is to upgrade Apache ActiveMQ Broker or Apache ActiveMQ to versions 5.19.5 or 6.2.3 or later, where this vulnerability is fixed.

Until the upgrade can be performed, restrict access to the Jolokia JMX-HTTP bridge endpoint (/api/jolokia/) to trusted and authenticated users only, and review the Jolokia access policy to limit or disable exec operations on sensitive MBeans.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify how this vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0