← back
CVE-2026-34197

Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans

CVSS 8.8 HIGHEPSS 96.3%● KEVCWE-20CWE-94
In short

Authenticated users of Apache ActiveMQ can execute arbitrary code on the server by exploiting a flaw in how the Jolokia web interface validates commands sent to the broker. An attacker sends a specially crafted network connector configuration that tricks the system into loading and running malicious code from a remote location.

Technical detail

CWE-20 (improper input validation) and CWE-94 (code injection) in Apache ActiveMQ's Jolokia JMX-HTTP bridge (/api/jolokia/) allow authenticated attackers to achieve RCE via BrokerService.addNetworkConnector() or addConnector() operations with a malicious discovery URI. The VM transport's brokerConfig parameter loads a remote Spring XML context through ResourceXmlApplicationContext, which instantiates singleton beans before validation, enabling code execution through bean factory methods. Affects versions before 5.19.4 and 6.0.0–6.2.3.

Summary generated and translated by AI from the official description.
Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec(). This issue affects Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ All: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ: before 5.19.4, from 6.0.0 before 6.2.3. Users are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Apache Software Foundation · Apache ActiveMQApache Software Foundation · Apache ActiveMQ AllApache Software Foundation · Apache ActiveMQ Broker
public PoCs found — 5
githubgithub.com/Catherines77/ActiveMQ-EXPtools★ 77githubgithub.com/hnytgl/CVE-2026-34197★ 1githubgithub.com/rootdirective-sec/CVE-2026-34197-Lab★ 0githubgithub.com/LAT-06/CVE-2026-34197★ 0githubgithub.com/asdasddqwdq29-a11y/CVE-2026-34197★ 0
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
https://activemq.apache.org/security-advisories.data/CVE-2026-34197-announcement.txthttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34197http://www.openwall.com/lists/oss-security/2026/04/06/3