CVE-2026-40466

Published Apr 24, 2026

Last updated 2 months ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-40466 is a remote code execution vulnerability affecting Apache ActiveMQ Broker, Apache ActiveMQ All, and Apache ActiveMQ. This flaw stems from improper input validation and improper control of code generation, allowing an authenticated attacker to bypass a previous security fix (CVE-2026-34197). The bypass occurs when the `activemq-http` module is on the classpath, enabling the attacker to add a connector using an HTTP Discovery transport via `BrokerView.addNetworkConnector` or `BrokerView.addConnector` through Jolokia. A malicious HTTP endpoint can then return a VM transport through the HTTP URI, circumventing the validation intended by CVE-2026-34197. Subsequently, the attacker can leverage the VM transport's `brokerConfig` parameter to load a remote Spring XML application context using `ResourceXmlApplicationContext`. This process leads to arbitrary code execution on the broker's JVM, as `ResourceXmlApplicationContext` instantiates all singleton beans before the `BrokerService` validates the configuration, allowing for execution through methods such as `Runtime.exec()`.

Description: Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. An authenticated attacker may bypass the fix in CVE-2026-34197 by adding a connector using an HTTP Discovery transport via BrokerView.addNetworkConnector or BrokerView.addConnector through Jolokia if the activemq-http module is on the classpath. A malicious HTTP endpoint can return a VM transport through the HTTP URI which will bypass the validation added in CVE-2026-34197. The attacker can then use the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec(). This issue affects Apache ActiveMQ Broker: before 5.19.6, from 6.0.0 before 6.2.5; Apache ActiveMQ All: before 5.19.6, from 6.0.0 before 6.2.5; Apache ActiveMQ: before 5.19.6, from 6.0.0 before 6.2.5. Users are recommended to upgrade to version 5.19.6 or 6.2.5, which fixes the issue.
Source: security@apache.org
NVD status: Analyzed
Products: activemq, activemq_broker

Risk scores

CVSS 3.1

Type: Secondary
Base score: 8.8
Impact score: 5.9
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

security@apache.org: CWE-20

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "550C287A-18F0-462A-BFC9-2AD8A64B951A",
            "versionEndExcluding": "5.19.6",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "F7BDD719-DDF9-42A2-AD9D-05FB6D758EF1",
            "versionEndExcluding": "6.2.5",
            "versionStartIncluding": "6.0.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  },
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:apache:activemq_broker:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "8799E3CE-EA55-4470-9582-D1948706DEAF",
            "versionEndExcluding": "5.19.6",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:apache:activemq_broker:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "429CAFE7-6C7F-4670-B62D-C0D4D97D440F",
            "versionEndExcluding": "6.2.5",
            "versionStartIncluding": "6.0.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.