CVE-2026-45505

A flaw was found in Apache ActiveMQ. This vulnerability allows an authenticated attacker to bypass a previous fix for CVE-2026-34197 by using non-parenthesized discovery wrappers. By crafting a malicious discovery URI, the attacker can trigger the VM transport's brokerConfig parameter to load a remote Spring XML application context, leading to arbitrary code execution on the broker's Java Virtual Machine (JVM).

Red Hat products ship Apache ActiveMQ Classic components as transitive dependencies. The vulnerability is an authenticated RCE via Jolokia JMX-over-HTTP on the Classic ActiveMQ web console, bypassing the fix for CVE-2026-34197. The Classic web console with Jolokia is not deployed in any Red Hat product — Red Hat Fuse 7 removed the embedded broker in version 7.0 and ships only client JARs. Red Hat AMQ Broker is based on Apache ActiveMQ Artemis with its own management interface. The Jolokia attack surface does not exist in Red Hat product deployments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.