CVE-2026-45505: Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Jolokia `addNetworkConnector` Discovery Wrapper Bypass

Synopsis

A code injection vulnerability in Apache ActiveMQ allows an authenticated attacker to achieve remote code execution on the broker's JVM. The attack is reachable over the network through the Jolokia JMX-HTTP bridge exposed on the ActiveMQ web console, and requires only a low-privilege account. By invoking broker MBean operations with a crafted discovery URI, an attacker can load a remote Spring XML application context and execute arbitrary OS commands through bean factory methods. Patched-image rebuilds at versions 5.19.7 and 6.2.6 are available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the ActiveMQ web console over the network to invoke the Jolokia JMX-HTTP bridge at /api/jolokia/.

• AuthenticationRequired

  A valid account is required, but any low-privilege credential is sufficient to invoke the targeted MBean exec operations.

• Victim interactionNot required

  No user interaction is needed; the attacker invokes the Jolokia endpoint directly without involving any other user.

• Attack complexityDetail

  The exploit is reliable and condition-free once network access and a low-privilege account are in hand, requiring no race conditions or special environmental setup.

Blast Radius

• The attacker executes arbitrary OS commands on the broker's JVM, giving full control over the ActiveMQ process and the host account it runs under.
• All data transiting the broker, including message payloads and credentials stored in the broker configuration, is readable by the attacker.
• The attacker can modify or delete messages, queues, topics, and broker configuration, corrupting any workload that depends on the message bus.
• The attacker can crash or permanently disable the broker, cutting off all messaging traffic routed through the affected ActiveMQ instance.