Apache ActiveMQ Jolokia JMX-HTTP Bridge Remote Code Execution Vulnerability Advisory (CVE-2026-34197)

1. Apply Official Security Patches

Upgrade your Apache ActiveMQ deployments to the designated secure releases:

• For 5.19.x users: Upgrade to 5.19.4 or higher
• For 6.x users: Upgrade to 6.2.3 or higher

2. Temporary Mitigations & Workarounds

If immediate patching is not feasible, implement the following defensive measures:

A. Restrict Jolokia Access Policy (jolokia-access.xml)

Modify the conf/jolokia-access.xml configuration file to restrict or disable exec operations:

<!-- Example modification in conf/jolokia-access.xml -->
<strict-checking />
<commands>
    <command>read</command>
    <command>write</command>
    <!-- Remove or restrict <command>exec</command> -->
</commands>

B. Network Segmentation and Access Control

• Block external access to the Jolokia API endpoint (/api/jolokia/) using a web application firewall (WAF) or reverse proxy.
• Restrict access to the ActiveMQ Web Console to trusted administrative IP ranges only.

Vulnerability Overview & Root Cause

This vulnerability (CVE-2026-34197) stems from Improper Input Validation and Code Injection (CWE-94, CWE-20) within the Jolokia JMX-HTTP bridge (`/api/jolokia/`) exposed by default on the Apache ActiveMQ Classic web console.

By default, the Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*). This exposure allows authenticated users to invoke sensitive management operations, specifically BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String).

Exploit Mechanics

• Authentication: The attacker authenticates to the ActiveMQ web console to access the Jolokia API.
• MBean Invocation: The attacker sends a crafted HTTP request to Jolokia to invoke BrokerService.addNetworkConnector.
• Spring XML Loading: The request includes a crafted discovery URI containing the VM transport's brokerConfig parameter. This parameter forces the application to load a remote Spring XML application context using ResourceXmlApplicationContext.
• Arbitrary Code Execution: Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, any bean factory methods (such as Runtime.exec()) defined in the attacker's remote XML are executed immediately within the broker's JVM context.

Business Impact & Severity

With a CVSS score of 8.8 (High) and its inclusion in the CISA KEV catalog, this vulnerability poses an active and severe threat. Successful exploitation grants full system-level execution privileges under the ActiveMQ process, potentially leading to complete host compromise and lateral movement within the enterprise network.