CVE-2026-34197: Apache ActiveMQ Improper Input Validation Vulnerability
Apache ActiveMQ contains an improper input validation vulnerability that allows for code injection.
Overview
Apache ActiveMQ exposes a Jolokia JMX-HTTP bridge at its web console that, in versions before 5.19.4 and in the 6.x line before 6.2.3, can be abused by an authenticated attacker to achieve arbitrary code execution on the broker host. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans without restriction, and the broker does not validate the discovery URI passed to connector management operations before acting on it. An attacker who can log in to the web console can exploit this to run arbitrary OS commands under the privileges of the ActiveMQ process.
Vulnerability details
The Jolokia JMX-HTTP bridge at /api/jolokia/ exposes ActiveMQ MBeans over HTTP, including BrokerService.addNetworkConnector() and BrokerService.addConnector(). The broker fails to validate the discovery URI supplied to these operations before passing it to the VM transport layer. When the URI includes a brokerConfig parameter, the VM transport loads a Spring XML application context from the specified location using ResourceXmlApplicationContext. Because Spring instantiates all singleton beans during context initialization, before BrokerService performs any configuration validation, the broker has no opportunity to reject the input after the remote context is fetched.
An attacker with valid credentials to the ActiveMQ web console sends an authenticated HTTP POST to /api/jolokia/ invoking BrokerService.addNetworkConnector() or BrokerService.addConnector() with a crafted discovery URI. The brokerConfig parameter in that URI points to an attacker-controlled remote Spring XML file. When the broker fetches and processes that file, bean factory methods such as Runtime.exec() execute arbitrary OS commands in the broker's JVM process. The attacker must be able to host a reachable Spring XML context file and must hold credentials for the web console, but no elevated privilege level within ActiveMQ is specified beyond authenticated access.
Severity and impact
Exploitation status
This vulnerability is confirmed as actively exploited in the wild — it is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
Detection and monitoring
- Monitor web console access logs for POST requests to /api/jolokia/ that invoke exec operations on org.apache.activemq:* MBeans, particularly calls to BrokerService.addNetworkConnector or BrokerService.addConnector with URI values containing a brokerConfig parameter.
- Watch for unexpected outbound network connections from the ActiveMQ broker process to external hosts shortly after Jolokia exec calls, which may indicate the broker fetching a remote Spring XML application context.
- Audit broker process activity for unexpected child processes spawned by the ActiveMQ JVM, such as shell interpreters or system utilities, which would indicate successful Runtime.exec() invocation.
Remediation
Additional hardening
- Upgrade Apache ActiveMQ to version 5.19.4 or later on the 5.x line, or to 6.2.3 or later on the 6.x line, as these releases address the vulnerability.
- Restrict the Jolokia access policy by replacing the default permissive configuration with an explicit allowlist that denies exec operations on BrokerService MBeans, or disable the Jolokia endpoint entirely if JMX-HTTP access is not required.
- Place the ActiveMQ web console behind a network control that limits access to trusted administrative hosts only, preventing unauthenticated or broadly authenticated users from reaching /api/jolokia/ from untrusted network segments.
- Apply egress filtering on the broker host to block outbound connections to arbitrary external URLs, reducing the broker's ability to fetch attacker-controlled remote Spring XML application context files.
Key dates
References
- https://activemq.apache.org/security-advisories.data/CVE-2026-34197-announcement.txt
- https://nvd.nist.gov/vuln/detail/CVE-2026-34197
- http://www.openwall.com/lists/oss-security/2026/04/06/3
- https://bugzilla.redhat.com/show_bug.cgi?id=2455869
- https://access.redhat.com/security/cve/CVE-2026-34197
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34197.json
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34197
Frequently asked questions
Does CVE-2026-34197 affect my FedRAMP authorization?
If Apache ActiveMQ runs inside your authorization boundary, yes. CVE-2026-34197 appears in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of April 30, 2026, a date that has already passed. For a FedRAMP-authorized service, an unpatched KEV in the boundary is a finding. An overdue one is a finding your assessor and sponsoring agency can see right now. Your options are to remediate it or formally document the mitigation and the delay.
How does Knox help me handle CVE-2026-34197?
Knox does not patch your software. Remediating Apache ActiveMQ is your responsibility under the FedRAMP shared-responsibility model. What Knox provides is the pre-authorized, single-tenant boundary to remediate within, along with Knox's automated continuous monitoring platform and audit-artifact coverage that document the fix for your next assessment. The remediation work is yours to carry out; maintaining your compliance posture while you carry it out is not something you manage on your own.
How does Knox's monitoring help with vulnerabilities like this?
Knox's automated continuous monitoring platform watches your environment for newly disclosed vulnerabilities and compliance issues on a continuous basis. For a CVE like CVE-2026-34197, exposure surfaces during ongoing monitoring rather than only when an assessor flags it at a scheduled review, giving you a shorter window between disclosure and awareness.
How do I get FedRAMP authorized with Knox?
Knox runs a FedRAMP-as-a-Service platform. It gives SaaS vendors a pre-authorized cloud boundary on AWS, Azure, and GCP. Your application inherits 60-80% of the required security controls. You reach FedRAMP authorization in about 90 days for roughly 90% less than the traditional $3.5M path. Book a meeting and Knox will map your path to authorization.
CVE-2026-34197's remediation deadline of April 30, 2026 has passed. What happens now?
If CVE-2026-34197 remains unremediated, it is already a Plan of Action and Milestones (POA&M) item. A growing POA&M list is what turns a routine continuous-monitoring review into a difficult agency conversation. Closing out the finding and documenting why the deadline was missed is what keeps your authorization clean and the agency relationship intact.
Access continuous compliance
We never compromise on security. Meet with our team to discuss scope, readiness, and map your company’s accelerated path to government certification.
_Horizontal_RGB.png)
