Executive Summary

CVE-2026-42588 is a vulnerability in Apache ActiveMQ Broker and related packages that allows an authenticated attacker to execute arbitrary code on the broker's JVM.

The issue arises because the Jolokia JMX-HTTP bridge exposed at /api/jolokia/ on the web console permits exec operations on all ActiveMQ MBeans, including BrokerService.addNetworkConnector(String).

An attacker can exploit this by sending a crafted discovery URI that triggers the VM transport's brokerConfig parameter using a "masterslave://" URL, which loads a Spring XML application context via ResourceXmlApplicationContext.

Since Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, this leads to arbitrary code execution through bean factory methods such as Runtime.exec().

This vulnerability affects Apache ActiveMQ versions before 5.19.7 and from 6.0.0 before 6.2.6.

Users are recommended to upgrade to version 5.19.7 or 6.2.6 to fix this issue.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an authenticated attacker to execute arbitrary code on the Apache ActiveMQ broker's JVM.

Such arbitrary code execution can lead to full compromise of the broker service, potentially allowing the attacker to manipulate messaging operations, disrupt service availability, or use the broker as a pivot point for further attacks within the network.

Because the exploit involves executing code via the Spring XML application context, it can be used to run any commands or payloads that the attacker chooses, leading to severe security risks.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the Jolokia JMX-HTTP bridge exposed at /api/jolokia/ on the Apache ActiveMQ web console, which permits exec operations on all ActiveMQ MBeans including BrokerService.addNetworkConnector(String).

To detect this vulnerability, you can check if your Apache ActiveMQ instance exposes the Jolokia endpoint at /api/jolokia/ and whether the default Jolokia access policy is in place allowing exec operations.

You may use HTTP requests or tools like curl to test access to the Jolokia endpoint and attempt to invoke MBean operations requiring authentication.

• curl -u <username>:<password> http://<activemq-host>:<port>/api/jolokia/
• curl -u <username>:<password> -H 'Content-Type: application/json' -d '{"type":"exec","mbean":"org.apache.activemq:type=Broker,brokerName=localhost","operation":"addNetworkConnector","arguments":["masterslave://..."]}' http://<activemq-host>:<port>/api/jolokia/

If these commands succeed in invoking exec operations on MBeans, your system is vulnerable.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to upgrade Apache ActiveMQ to version 5.19.7 or 6.2.6 or later, where this vulnerability is fixed.

Additionally, restrict access to the Jolokia JMX-HTTP bridge endpoint (/api/jolokia/) by enforcing strong authentication and limiting network exposure.

Review and tighten Jolokia access policies to prevent exec operations on ActiveMQ MBeans unless absolutely necessary.

Monitor and audit usage of Jolokia endpoints to detect any unauthorized or suspicious activity.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify how this vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0