CVE-2026-34197 - Apache ActiveMQ Jolokia Remote Code Execution (RCE)

CVE-2026-34197 is a high severity Remote Code Execution (RCE) vulnerability affecting Apache ActiveMQ Classic. The issue exists within the Jolokia JMX-HTTP bridge, which exposes management operations over HTTP through the /api/jolokia/ endpoint.

The default Jolokia access policy permits authenticated users to invoke management operations on ActiveMQ MBeans. Certain broker management methods accept user-controlled discovery URIs. A specially crafted URI can cause ActiveMQ to load a remote Spring XML application context before broker configuration validation occurs.

During initialization, Spring instantiates singleton beans immediately. Since bean initialization occurs prior to ActiveMQ validating the supplied configuration, attacker-controlled bean definitions may execute arbitrary Java code inside the broker's JVM. This can ultimately result in complete compromise of the ActiveMQ process with the privileges of the running service.

---

Technical Details

The vulnerability affects the interaction between several components:

• Apache ActiveMQ Classic
• Jolokia JMX-HTTP Bridge
• Java Management Extensions (JMX)
• BrokerService management operations
• Spring Framework's ResourceXmlApplicationContext

Normally, administrative operations exposed through Jolokia are intended for broker management. However, certain broker methods accept external configuration references.

Because Spring loads and instantiates beans immediately, malicious bean definitions may execute before ActiveMQ verifies whether the supplied configuration should have been accepted.