Code Injection in ActiveMQ - CVE-2026-45505

Vulnerability details

The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper input validation and code injection in the Jolokia JMX-HTTP bridge and BrokerService.addNetworkConnector(String)/addConnector(String) operations when handling crafted discovery URIs through the /api/jolokia/ web console endpoint. A remote user can invoke these operations with a specially crafted discovery URI to execute arbitrary code.

The issue involves non-parenthesized discovery wrappers such as masterslave:vm://...,... and static:vm://... that bypass prior validation, causing the VM transport's brokerConfig parameter to load a remote Spring XML application context via ResourceXmlApplicationContext before configuration validation completes.

Affected software

How to mitigate CVE-2026-45505

External References

• https://lists.apache.org/api/email.lua?id=d6osvylbdvzrhw62xj6q9jxo34rdl9tw

Related Security Bulletins

• Multiple vulnerabilities in ActiveMQ
• openEuler 24.03 LTS SP3 update for activemq
• openEuler 24.03 LTS SP1 update for activemq
• openEuler 22.03 LTS SP4 update for activemq
• Multiple vulnerabilities in Bamboo Data Center