CVE-2026-34197
Improper Input Validation, Improper Control of Generation of Code ('Code Injection')…
Technology
Apache ActiveMQ
CVSS Score
8.8 / 10.0
Affected Versions
<5.19.4; >=6.0.0 <6.2.3
Upstream Fix
See upstream advisory
Published
April 7, 2026
OSSeva Coverage
Fixed upstream
Description
Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicat
Is your Apache ActiveMQ deployment affected?
If you're running <5.19.4; >=6.0.0 <6.2.3, you need this patch. Book a discovery call to get covered.