Code Injection in ActiveMQ - CVE-2026-45505

Detailed vulnerability description

The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper input validation and code injection in the Jolokia JMX-HTTP bridge and BrokerService.addNetworkConnector(String)/addConnector(String) operations when handling crafted discovery URIs through the /api/jolokia/ web console endpoint. A remote user can invoke these operations with a specially crafted discovery URI to execute arbitrary code.

The issue involves non-parenthesized discovery wrappers such as masterslave:vm://...,... and static:vm://... that bypass prior validation, causing the VM transport's brokerConfig parameter to load a remote Spring XML application context via ResourceXmlApplicationContext before configuration validation completes.

How to mitigate CVE-2026-45505

Sources

• https://lists.apache.org/api/email.lua?id=d6osvylbdvzrhw62xj6q9jxo34rdl9tw