CVE-2026-45505
Improper Input Validation, Improper Control of Generation of Code ('Code Injection')…
Technology
Apache ActiveMQ
CVSS Score
8.8 / 10.0
Affected Versions
<5.19.7; >=6.0.0 <6.2.6
Upstream Fix
See upstream advisory
Published
June 1, 2026
OSSeva Coverage
Fixed upstream
Description
Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. Non-parenthesized discovery wrappers such as `masterslave:vm://...,...` and `static:vm://...` incorrectly pass validation allowing bypass of fix in CVE-2026-34197. Original description from CVE-2026-34197. Apache ActiveMQ exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(St
Is your Apache ActiveMQ deployment affected?
If you're running <5.19.7; >=6.0.0 <6.2.6, you need this patch. Book a discovery call to get covered.