CVE-2026-42588

Published Jun 1, 2026

Last updated 2 months ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-42588 describes a vulnerability found in Apache ActiveMQ Broker, Apache ActiveMQ All, and Apache ActiveMQ. This flaw stems from improper input validation and a code injection vulnerability within the Jolokia JMX-HTTP bridge, which is exposed on the web console at `/api/jolokia/`. An authenticated attacker can exploit this by crafting a discovery URI. This URI triggers the VM transport's `brokerConfig` parameter using a "masterslave://" URL, which allows for loading a Spring XML application context via `ResourceXmlApplicationContext`. Because Spring's `ResourceXmlApplicationContext` instantiates all singleton beans before the `BrokerService` validates the configuration, this can lead to arbitrary code execution on the broker's Java Virtual Machine (JVM) through bean factory methods like `Runtime.exec()`. Affected versions include Apache ActiveMQ Broker, Apache ActiveMQ All, and Apache ActiveMQ before 5.19.7, and from 6.0.0 before 6.2.6. Users are advised to upgrade to version 5.19.7 or 6.2.6 to address this issue.

Description: Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String). An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter using the "masterslave:// " URL which can allow loading a Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec(). This issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ All: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6. Users are recommended to upgrade to version 5.19.7 or 6.2.6, which fixes the issue.
Source: security@apache.org
NVD status: Analyzed
Products: activemq, activemq_broker

Risk scores

CVSS 3.1

Type: Secondary
Base score: 8.1
Impact score: 5.2
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Severity: HIGH

Weaknesses

security@apache.org: CWE-20

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "793E68E6-9024-4518-B062-42B2DE5BB555",
            "versionEndExcluding": "5.19.7",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "FFF44DB9-1850-4B5F-AD0F-55CB5219AB22",
            "versionEndExcluding": "6.2.6",
            "versionStartIncluding": "6.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:apache:activemq_broker:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "FE27E832-0E65-4D05-A2EE-271152799E96",
            "versionEndExcluding": "5.19.7",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:apache:activemq_broker:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "94F0DB6E-BEF4-4BEB-92F5-3A7B65172CC2",
            "versionEndExcluding": "6.2.6",
            "versionStartIncluding": "6.0.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.