CVE-2026-45505: Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache…

PriorityP261high8.8CVSS 3.1

AVNACLPRLUINSUCHIHAH

EPSS

0.58%

43.7th percentile

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. Non-parenthesized discovery wrappers such as `masterslave:vm://...,...` and `static:vm://...` incorrectly pass validation allowing bypass of fix in CVE-2026-34197. Original description from CVE-2026-34197. Apache ActiveMQ exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). An authenticated attacker can invoke these operations with a crafted discovery UR that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec(). This issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ All: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6. Users are recommended to upgrade to version 5.19.7 or 6.2.6, which fixes the issue.

Affected

7 ranges

Vendor	Product	Version range	Fixed in
apache	activemq	< 5.19.7	5.19.7
apache	activemq	>= 6.0.0 < 6.2.6	6.2.6
apache	activemq_broker	< 5.19.7	5.19.7
apache	activemq_broker	>= 6.0.0 < 6.2.6	6.2.6
candlepinproject	candlepin	—	—
log4j_2	log4j	—	—
satellite_el8	candlepin	—	—

Detection & IOCsextracted from sources · hover to see the quote

url/api/jolokia/↗

commandmasterslave:vm://...,...↗

commandstatic:vm://...↗

→Monitor HTTP requests to the Jolokia JMX-HTTP bridge endpoint /api/jolokia/ on the ActiveMQ web console for exec operations targeting ActiveMQ MBeans, specifically BrokerService.addNetworkConnector and BrokerService.addConnector. ↗
→Detect crafted discovery URIs using non-parenthesized wrappers (e.g., masterslave:vm:// or static:vm://) passed to BrokerService MBean operations via Jolokia, which bypass the parenthesized-wrapper validation introduced in CVE-2026-34197. ↗
→Alert on the VM transport's brokerConfig parameter referencing remote URLs (http://, https://, ftp://) in discovery URIs, which triggers ResourceXmlApplicationContext to load a remote Spring XML application context leading to RCE. ↗
→Look for unexpected child processes spawned from the ActiveMQ broker JVM process (e.g., via Runtime.exec()), which may indicate successful exploitation through Spring bean factory methods. ↗

·Exploitation requires authentication to the ActiveMQ web console; unauthenticated attackers cannot directly exploit this vulnerability. ↗
·The Jolokia attack surface is specific to Apache ActiveMQ Classic's web console; Red Hat AMQ Broker (based on Artemis) and Red Hat Fuse 7 (ships only client JARs) do not expose this attack surface in their default deployments. ↗
·This CVE is a bypass of the fix introduced in CVE-2026-34197; environments that applied the CVE-2026-34197 patch but have not upgraded to ActiveMQ 5.19.7 or 6.2.6 remain vulnerable via non-parenthesized discovery wrapper syntax. ↗

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

ghsa8.8HIGH

vendor_redhat8.8HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.