CVE-2026-42588: Apache ActiveMQ RCE Vulnerability

CVE-2026-42588 Overview

CVE-2026-42588 is a code injection vulnerability in Apache ActiveMQ Classic that allows authenticated attackers to execute arbitrary code on the broker's Java Virtual Machine (JVM). The flaw resides in the Jolokia JMX-HTTP bridge exposed at /api/jolokia/ on the ActiveMQ web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans, including BrokerService.addNetworkConnector(String). By supplying a crafted masterslave:// discovery URI, an attacker can trigger the VM transport's brokerConfig parameter to load a Spring XML application context through ResourceXmlApplicationContext, leading to remote code execution.

Critical Impact

Authenticated attackers can achieve arbitrary code execution on the broker JVM by abusing the Jolokia bridge to load attacker-controlled Spring XML configurations.

Affected Products

• Apache ActiveMQ Broker: versions before 5.19.7 and versions 6.0.0 before 6.2.6
• Apache ActiveMQ All: versions before 5.19.7 and versions 6.0.0 before 6.2.6
• Apache ActiveMQ: versions before 5.19.7 and versions 6.0.0 before 6.2.6

Discovery Timeline

• 2026-06-01 - CVE-2026-42588 published to NVD
• 2026-06-01 - Last updated in NVD database

Technical Details for CVE-2026-42588

Vulnerability Analysis

Apache ActiveMQ Classic ships with a Jolokia JMX-HTTP bridge mounted at /api/jolokia/ on the web console. Jolokia's default access policy authorizes exec operations against every MBean under the org.apache.activemq:* domain. Among these MBeans is BrokerService.addNetworkConnector(String), which accepts a discovery URI as a string argument.

When an attacker passes a discovery URI using the masterslave:// scheme, ActiveMQ's VM transport parses the brokerConfig parameter and treats it as a Spring application resource. The runtime then instantiates ResourceXmlApplicationContext against the attacker-supplied resource. Spring eagerly instantiates all singleton beans before BrokerService validates the configuration, so bean factory methods such as Runtime.exec() execute during context initialization. The result is arbitrary code execution under the broker's JVM identity.

The weakness is classified as [CWE-20] Improper Input Validation, compounded by improper control of generated code. See the Apache Mailing List Thread for the vendor advisory.

Root Cause

The root cause is twofold. First, the default Jolokia policy permits exec invocations on broker MBeans without restricting which methods may be reached. Second, BrokerService.addNetworkConnector accepts a discovery URI string that flows into the VM transport, which dereferences brokerConfig and loads remote Spring XML without validating its source or contents.

Attack Vector

An authenticated user with access to the ActiveMQ web console issues a Jolokia HTTP POST request invoking addNetworkConnector on the BrokerService MBean. The argument is a masterslave:// URI whose brokerConfig parameter points to an attacker-hosted Spring XML file. Loading that context instantiates beans that call Runtime.exec() or equivalent factory methods, executing commands on the broker host. Refer to the OpenWall OSS-Security Update for additional technical context.

Detection Methods for CVE-2026-42588

Indicators of Compromise

• HTTP requests to /api/jolokia/ invoking the exec operation against MBeans matching org.apache.activemq:*, especially addNetworkConnector.
• Discovery URIs containing the masterslave:// scheme or a brokerConfig query parameter referencing external HTTP(S) resources.
• Unexpected child processes spawned by the ActiveMQ Java process, such as shells, curl, wget, or scripting interpreters.
• Outbound network connections from the broker host to untrusted servers immediately after Jolokia activity.

Detection Strategies

• Inspect ActiveMQ web console access logs for POST requests to /api/jolokia/ and alert on payloads containing addNetworkConnector or masterslave.
• Correlate Jolokia API activity with process creation telemetry on the broker host to identify suspicious child processes of the JVM.
• Hunt for outbound HTTP fetches from the broker host that retrieve XML resources shortly before a process spawn event.

Monitoring Recommendations

• Enable verbose access logging on the ActiveMQ web console and forward logs to a centralized analytics platform.
• Monitor JMX MBean invocation patterns and flag any exec call against BrokerService originating from unexpected user accounts.
• Baseline normal broker child-process behavior and alert on deviations such as command interpreters launched by the JVM.

How to Mitigate CVE-2026-42588

Immediate Actions Required

• Upgrade Apache ActiveMQ to version 5.19.7 or 6.2.6, which contain the official fix.
• Restrict network access to the ActiveMQ web console and the /api/jolokia/ endpoint to trusted administrative networks only.
• Audit existing web console credentials and rotate any that may have been exposed.
• Review broker hosts for signs of post-exploitation activity, including unexpected processes, files, and outbound connections.

Patch Information

The Apache ActiveMQ project has released fixed versions 5.19.7 and 6.2.6. Both releases address the unsafe Jolokia exec policy and the unsafe handling of the masterslave:// discovery URI inside the VM transport. Patch details are published in the Apache Mailing List Thread.

Workarounds

• Disable the Jolokia endpoint on the ActiveMQ web console if it is not required for operational tooling.
• Tighten the Jolokia access policy (jolokia-access.xml) to deny exec operations on org.apache.activemq:* MBeans, particularly addNetworkConnector.
• Enforce strong authentication and least-privilege roles for web console users until upgrades are completed.
• Place the broker behind a reverse proxy that filters Jolokia requests containing masterslave or external brokerConfig references.

# Example: restrict Jolokia exec operations via jolokia-access.xml
# Place the broker behind network ACLs and disable exec on broker MBeans
<restrict>
  <deny>
    <mbean>
      <name>org.apache.activemq:*</name>
      <operation>*</operation>
    </mbean>
  </deny>
</restrict>