CVE-2026-52760: Apache ActiveMQ Web Console XSS Flaw

CVE-2026-52760 Overview

CVE-2026-52760 is a stored cross-site scripting (XSS) vulnerability in the Apache ActiveMQ Web Console. The browse page renders the JMS message ID directly without sanitization. An authenticated producer can send a message with a crafted JMS message ID containing HTML or JavaScript. When an administrator browses the queue in the Web Console, the payload executes in the administrator's browser context. The flaw is tracked under [CWE-79] and affects Apache ActiveMQ and Apache ActiveMQ Web Console versions before 5.19.8, and versions from 6.0.0 before 6.2.7.

Critical Impact
An authenticated low-privilege producer can execute arbitrary JavaScript in an administrator's browser, enabling session hijacking, console actions on behalf of the administrator, and potential pivot to broker management functions.

Affected Products

Apache ActiveMQ versions before 5.19.8
Apache ActiveMQ versions from 6.0.0 before 6.2.7
Apache ActiveMQ Web Console (matching version ranges above)

Discovery Timeline

2026-06-30 - CVE-2026-52760 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-52760

Vulnerability Analysis

The Apache ActiveMQ Web Console exposes a queue browsing view that displays metadata about pending messages, including each message's JMS message identifier. The browse page inserts the message ID into the rendered HTML without applying output encoding or sanitization. Because JMS producers can set the message ID string on outbound messages, an authenticated attacker with producer privileges can plant a payload that persists in the queue.

When an administrator opens the browse view for the affected queue, the browser parses the injected markup and executes any embedded JavaScript. The attack requires user interaction from the administrator, but no additional privileges beyond message production are needed on the attacker side. Because the payload runs in the administrator's authenticated session, it can invoke Web Console actions such as purging queues, deleting subscriptions, or altering broker configuration.

Root Cause

The root cause is missing output encoding on the message ID field in the queue browse view. User-controlled JMS header data reaches the HTML sink without being HTML-escaped, satisfying the classic pattern captured by [CWE-79]. Apache resolved the issue in ActiveMQ 6.2.7 and 5.19.8 by sanitizing the field before rendering.

Attack Vector

Exploitation follows this sequence:

The attacker authenticates to the broker with producer permissions on a target queue.
The attacker publishes a message with a JMS message ID containing an HTML or JavaScript payload, for example an inline <script> element or an event-handler attribute on an image tag.
The malicious message sits in the queue until an administrator opens the browse view.
The Web Console renders the ID unescaped, and the payload executes in the administrator's browser under the Web Console origin.

No verified public exploit code was available at the time of publication. See the Apache Security Discussion Thread for vendor details.

Detection Methods for CVE-2026-52760

Indicators of Compromise

JMS message IDs in broker logs or persistence stores containing HTML characters such as <, >, ", or script substrings.
Web Console access logs showing administrator sessions immediately followed by unexpected management API calls originating from the same session.
Unexplained queue modifications, subscription deletions, or configuration changes shortly after an administrator browsed a queue.

Detection Strategies

Inspect ActiveMQ message stores and audit logs for JMS message IDs that do not conform to the expected ID:hostname-port-timestamp-counter format.
Deploy a Content Security Policy in reverse proxy configurations fronting the Web Console and monitor CSP violation reports for inline script attempts.
Correlate producer authentication events with subsequent administrator browse actions to identify potential injection-to-execution chains.

Monitoring Recommendations

Alert on Web Console management endpoints being invoked within seconds of a queue browse request from the same session.
Monitor broker versions across the fleet and flag any instance running Apache ActiveMQ below 5.19.8 or in the 6.0.0-6.2.6 range.
Enable and centralize ActiveMQ audit logging to retain producer identity for messages currently held in queues.

How to Mitigate CVE-2026-52760

Immediate Actions Required

Upgrade Apache ActiveMQ and the Web Console to version 6.2.7 or 5.19.8 on all broker nodes.
Purge or inspect existing queues for messages with suspicious JMS message IDs before administrators next open the browse view.
Restrict producer credentials so that only trusted applications can publish to queues visible from the Web Console.

Patch Information

Apache released fixed versions 6.2.7 and 5.19.8, which sanitize the message ID before rendering in the browse page. Details are published in the Apache Security Discussion Thread and the Openwall OSS Security Mailing List Update.

Workarounds

Restrict Web Console access to a small set of administrator IP addresses through a reverse proxy or firewall until patching completes.
Enforce a strict Content Security Policy that disallows inline scripts on the Web Console origin.
Temporarily disable the Web Console on production brokers and manage queues via JMX or CLI tooling until upgrades are deployed.

bash

# Verify installed ActiveMQ version and confirm patched release
${ACTIVEMQ_HOME}/bin/activemq --version

# Example: restrict Web Console to internal admin subnet via nginx
# location /admin/ {
#     allow 10.0.10.0/24;
#     deny all;
#     proxy_pass http://127.0.0.1:8161/admin/;
# }