CVE-2026-34197 ActiveMQ Classic Security Detection Tool

This is an Apache ActiveMQ Classic exposure detection tool for defense and internal network reconnaissance, used to assist in assessing risks related to CVE-2026-34197.

This project does not contain exploit code, does not execute Jolokia exec, does not create connectors, does not load remote XML, and does not modify Broker state. The tool only performs read-only HTTP probes and optional local configuration checks, suitable for security inspections in authorized internal environments.

Detection Approach

The tool does not rely solely on version numbers, but combines multiple types of evidence:

• Whether the ActiveMQ Classic version is within the affected range;
• Whether /api/jolokia/version is accessible;
• Whether Jolokia requires authentication;
• Whether ActiveMQ MBean metadata can be read via Jolokia;
• Whether the metadata exposes operation names that could change runtime state;
• Whether there are risk signs in the local configuration such as overly broad Jolokia access policies, disabled authentication, or wide binding.

These checks are all read-only actions, aimed at helping to assess the exposure surface and prioritization of hardening.

Usage

Check version:

python3 activemq_cve_2026_34197_checker.py --version 5.18.3

Check Jolokia exposure surface:

python3 activemq_cve_2026_34197_checker.py --url http://127.0.0.1:8161

Check with authentication:

python3 activemq_cve_2026_34197_checker.py \
  --url http://127.0.0.1:8161 \
  --username admin \
  --password admin

Scan local configuration directory:

python3 activemq_cve_2026_34197_checker.py --config-path /opt/activemq/conf

Combined check:

python3 activemq_cve_2026_34197_checker.py \
  --version 5.18.3 \
  --url http://127.0.0.1:8161 \
  --config-path /opt/activemq/conf

Output Description

The tool outputs JSON, with key fields including:

• version: version input and version risk assessment;
• jolokia: Jolokia read-only probe results;
• config_path: local configuration scan path;
• findings: discovered risk points, levels, reasons, and evidence;
• remediation: remediation and hardening suggestions.

Common risk signals include:

• Jolokia interface accessible without authentication;
• ActiveMQ MBean metadata can be enumerated;
• Broker operations that modify runtime state are visible in Jolokia metadata;
• jolokia-access.xml policy too broad;
• Authentication appears disabled in configuration;
• Jolokia-related services bound to a wide address.

Remediation Suggestions

It is recommended to prioritize upgrading Apache ActiveMQ Classic to the fixed versions:

• 5.19.4 or later;
• 6.2.3 or later.

Also recommended:

• Restrict /api/jolokia/ and Web Console to only be accessible from trusted management network segments;
• Review jolokia-access.xml, disallow broad exec and sensitive MBean operations;
• Avoid using default credentials;
• If compromise is suspected, rotate Broker-related credentials and audit access logs;
• Add access controls for management interfaces on boundary proxies or WAF.

Security Boundary

This tool is not an exploit and not a vulnerability trigger. It will not:

• Call Jolokia exec;
• Create, update, or delete connectors;
• Cause ActiveMQ to load remote configuration;
• Write to Broker configuration;
• Execute system commands.

It is suitable as an auxiliary tool for internal security inspections, asset exposure verification, and hardening validation.

Reference Links

• Apache ActiveMQ Security Advisory: https://activemq.apache.org/security-advisories.data/CVE-2026-34197-announcement.txt
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-34197