📖 Overview

CVE-2026-34197 is a high-severity authenticated remote code execution vulnerability affecting Apache ActiveMQ Classic.

The issue exists in the Jolokia JMX-HTTP bridge exposed through:

/api/jolokia/

An authenticated attacker can abuse dangerous MBean methods such as:

• BrokerService.addNetworkConnector(String)
• BrokerService.addConnector(String)

By supplying a crafted discovery URI, the broker loads a remote Spring XML application context, which can instantiate malicious beans before validation occurs, leading to arbitrary code execution on the broker JVM.

⚡ Impact

🎯 What an attacker gains

• Remote command execution
• Full broker takeover
• Credential harvesting
• Lateral movement inside internal networks
• Ransomware deployment risk
• Persistent backdoor via malicious Spring beans

🧠 Technical Root Cause

The vulnerability is caused by:

• Improper input validation
• Unsafe code generation / bean instantiation flow
• Dangerous default Jolokia exec permissions

🔗 Vulnerable flow

graph TD
    A[Authenticated User] --> B[/api/jolokia/]
    B --> C[exec MBean method]
    C --> D[addConnector / addNetworkConnector]
    D --> E[Crafted discovery URI]
    E --> F[Remote Spring XML Load]
    F --> G[Bean Instantiation]
    G --> H[Arbitrary JVM Code Execution]

📸 Screenshot

📦 Affected Versions

❌ Vulnerable

• Apache ActiveMQ < 5.19.4
• Apache ActiveMQ 6.0.0 - 6.2.2
• activemq-all in matching ranges

✅ Fixed

• 5.19.5
• 6.2.3

🛡️ Mitigation

Immediate actions

# Upgrade immediately
5.19.5+
6.2.3+

Defense checklist

• Upgrade broker version
• Restrict /api/jolokia/
• Disable Jolokia if unused
• Rotate admin credentials
• Review addConnector logs
• Restrict console to VPN/internal hosts
• Enable WAF reverse proxy rules

🔍 Detection Ideas

Search logs for suspicious patterns:

/api/jolokia/exec
addNetworkConnector
addConnector
brokerConfig=
ResourceXmlApplicationContext
Runtime.exec

🧪 SIEM Hunt Query (Pseudo)

SELECT * FROM logs
WHERE path LIKE '%jolokia%'
AND (
  message LIKE '%addConnector%'
  OR message LIKE '%brokerConfig=%'
)

🚀 Why This Matters

This bug is especially dangerous because ActiveMQ brokers are often:

• exposed on internal admin networks
• trusted by multiple apps
• running with high OS privileges
• connected to sensitive queues and credentials

That makes this a strong initial access and lateral movement vector.

🏷️ Tags

#cve #activemq #rce #apache #jolokia #redteam #blueteam #threatdetection