CVE-2026-34197

A flaw was found in Apache ActiveMQ Broker and Apache ActiveMQ. An authenticated attacker can exploit this vulnerability by sending a specially crafted discovery Uniform Resource Identifier (URI) to the Jolokia JMX-HTTP bridge, which is exposed on the web console. This allows the attacker to bypass configuration validation and load a remote Spring XML application context. Consequently, this leads to arbitrary code execution on the broker's Java Virtual Machine (JVM).

This is an Important severity flaw as it could enable a remote, authenticated attacker to execute arbitrary code on the broker's JVM. This can be exploited by sending a specially crafted discovery URI to the Jolokia JMX-HTTP bridge, which is exposed on the web console. This bypasses configuration validation and allows loading a remote Spring XML application context.

The vulnerable components are used strictly at build time or for internal testing and are not included in shipped products. Consequently, Red Hat products are marked as unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.