CVE-2026-42588: Apache ActiveMQ Code Injection Vulnerability
Summary
CVE-2026-42588: Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ have a Code Injection issue. Affects org.apache.activemq:activemq-broker across 2 version ranges.
< 5.19.7
>= 6.0.0, < 6.2.6
Fixed in 5.19.7 or 6.2.6, depending on the release line you run. How to fix ↓
Also tracked for
- activemq · Bitnami
The same CVE-2026-42588 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache ActiveMQ is an open-source message broker that facilitates communication between different applications through message queuing. It supports various messaging protocols and provides features like high availability, clustering, and security. However, it has a vulnerability that allows code injection through improper input validation, which can lead to severe security risks.
Vulnerability Detail
The vulnerability arises from the improper validation of input in the Jolokia JMX-HTTP bridge exposed at /api/jolokia/ on the ActiveMQ web console. The default access policy allows exec operations on all ActiveMQ MBeans, enabling an authenticated attacker to execute arbitrary code by crafting a malicious discovery URI. This can trigger the VM transport's brokerConfig parameter, leading to the instantiation of Spring beans before configuration validation, resulting in arbitrary code execution on the broker's JVM.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 5.19.75.19.7 -
>= 6.0.0, < 6.2.66.2.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, restrict access to the Jolokia JMX-HTTP bridge by implementing stricter access controls or disabling the bridge entirely until the upgrade can be performed.
Conclusion
The Apache ActiveMQ code injection vulnerability (CVE-2026-42588) poses a significant risk due to improper input validation. Users are strongly advised to upgrade to the latest patched versions to mitigate this risk and ensure the security of their systems.
See every vulnerability recorded for org.apache.activemq:activemq-broker →
FAQ
The CVSS score of this vulnerability is 8.1, indicating a high severity level.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software by analyzing the pom.xml file. Visit Vulert Scanner to check your application without any signup.
If exploited, this vulnerability can lead to arbitrary code execution on the broker's JVM, potentially compromising the entire system.
All users of Apache ActiveMQ versions before 5.19.7 and between 6.0.0 and 6.2.6 are affected by this vulnerability.
If an immediate upgrade is not possible, implement stricter access controls on the Jolokia JMX-HTTP bridge as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.activemq:activemq-broker.
