CVE-2026-42588: Apache ActiveMQ Remote Code Execution via Jolokia addNetworkConnector
Summary
CVE-2026-42588: Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. Affects activemq across 2 version ranges.
< 5.19.7
>= 6.0.0, < 6.2.6
Fixed in 5.19.7 or 6.2.6, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2026-42588 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache ActiveMQ is an open-source message broker that facilitates communication between different applications through messaging. It supports various messaging protocols and provides features such as high availability, clustering, and message persistence. However, certain versions of ActiveMQ are vulnerable to a remote code execution flaw due to improper input validation in the Jolokia JMX-HTTP bridge, which can be exploited by authenticated attackers.
Vulnerability Detail
The vulnerability arises from the Jolokia JMX-HTTP bridge exposed at /api/jolokia/ on the ActiveMQ web console. The default access policy allows exec operations on all ActiveMQ MBeans, including BrokerService.addNetworkConnector(String). An authenticated attacker can exploit this by providing a crafted discovery URI that manipulates the brokerConfig parameter, leading to arbitrary code execution on the broker's JVM. This occurs because Spring's ResourceXmlApplicationContext instantiates singleton beans before the BrokerService validates the configuration, allowing attackers to execute arbitrary commands.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 5.19.75.19.7 -
>= 6.0.0, < 6.2.66.2.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can restrict access to the Jolokia endpoint by configuring the security settings to limit access to trusted users only. This can be done by modifying the Jolokia configuration file to include an access policy that denies exec operations for untrusted users.
Conclusion
The CVE-2026-42588 vulnerability in Apache ActiveMQ poses a significant risk of remote code execution due to improper input validation. Users are strongly advised to upgrade to the patched versions to mitigate this risk. Implementing temporary workarounds can provide additional security until an upgrade is feasible.
See every vulnerability recorded for activemq →
FAQ
CVE-2026-42588 is a vulnerability in Apache ActiveMQ that allows remote code execution through improper input validation in the Jolokia addNetworkConnector function.
The vulnerability affects Apache ActiveMQ Broker versions before 5.19.7 and from 6.0.0 before 6.2.6.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. You can also check your application in the Vulert playground without signup.
An attacker could execute arbitrary code on the broker's JVM, potentially leading to data breaches, service disruptions, or unauthorized access to sensitive information.
If immediate upgrading is not possible, implement security measures to restrict access to the Jolokia endpoint and monitor for any suspicious activity.
Related vulnerabilities
Recent vulnerabilities recorded for activemq.
