Critical Apache ActiveMQ Bug CVE-2023-46675 Lets Attackers Run Remote Code

Key Takeaways

• A critical vulnerability, CVE-2026-42253, in Apache ActiveMQ allows attackers to inject malicious HTTP headers, leading to potential cross-site scripting (XSS) and response manipulation.
• The flaw impacts Apache ActiveMQ versions prior to 5.19.7, and versions 6.0.0 up to but not including 6.2.6. Apache ActiveMQ Web components are also affected.
• A separate, high-severity vulnerability, CVE-2026-49157, was also disclosed, allowing low-privilege users to access sensitive Jolokia broker management functions.
• Patches are available in Apache ActiveMQ versions 5.19.7 and 6.2.6, which remediate both issues.

A significant security flaw has been identified in Apache ActiveMQ, enabling threat actors to inject malicious HTTP security headers. This vulnerability, tracked as CVE-2026-42253, stems from improper handling of message properties within the popular open-source messaging broker, creating a pathway for cross-site scripting (XSS) and other response manipulation attacks.

The issue affects both the core Apache ActiveMQ product and its web components, posing a risk to deployments where the web console is accessible or integrated into broader enterprise systems.

Deep Dive into the Header Injection Vulnerability

The root cause of CVE-2026-42253 lies within the MessageServlet of the ActiveMQ web console API. Researchers discovered that this servlet directly copies all Java Message Service (JMS) message properties into HTTP response headers without adequate validation or sanitization. This oversight creates a critical attack surface, allowing malicious actors to craft JMS messages containing harmful header values, which are then reflected directly in the HTTP response.

HTTP headers are fundamental to enforcing browser-side security policies, including Content Security Policy (CSP), X-Frame-Options, and Strict-Transport-Security (HSTS). By exploiting this flaw, attackers can overwrite or inject headers, thereby weakening or circumventing these crucial security protections. In practical scenarios, this could facilitate various attacks such as session hijacking, clickjacking, or the execution of cross-site scripting, particularly if the ActiveMQ web console is exposed to untrusted users or integrated into enterprise workflows.

The vulnerability specifically affects Apache ActiveMQ versions preceding 5.19.7, as well as versions 6.0.0 up to, but not including, 6.2.6. Similarly, Apache ActiveMQ Web versions before 5.19.7 and 6.x versions prior to 6.2.6 are also susceptible. The Apache Software Foundation has addressed this vulnerability by disabling and deprecating the MessageServlet component in the patched releases, thereby substantially reducing the potential attack surface.

Jolokia Permission Flaw Also Discovered

In parallel, another important vulnerability, CVE-2026-49157, has been identified in Apache ActiveMQ, stemming from incorrect default permissions. This flaw permits authenticated users with low privileges to maintain access to critical Jolokia broker management endpoints. Due to excessively permissive default authorization settings, non-administrative users could execute sensitive broker operations, such as creating or deleting queues, which should typically be restricted to administrative roles. This issue raises significant concerns regarding privilege escalation and unauthorized broker manipulation within multi-user environments.

Both vulnerabilities underscore systemic risks inherent in management interfaces exposed via web consoles and APIs, particularly when input validation and access control mechanisms are inadequate. Attackers targeting enterprise messaging systems could potentially chain these issues, manipulating broker behavior while simultaneously undermining frontend security protections.

The header injection flaw was credited to security researchers Vishal Shukla, pyn3rd, uname, and 4ra1n. Leon Johnson was credited with reporting the Jolokia permission issue.

What You Should Do

• Organizations utilizing Apache ActiveMQ are strongly advised to upgrade immediately to versions 5.19.7 or 6.2.6, as both vulnerabilities have been remediated in these releases.
• Administrators should meticulously review the exposure of the ActiveMQ web console, restricting access exclusively to trusted networks.
• Conduct thorough audits of message-handling logic to prevent the unsafe propagation of user-controlled data into HTTP responses.
• Given ActiveMQ’s widespread adoption in enterprise messaging and microservices architectures, these vulnerabilities pose a substantial risk if left unpatched, particularly in environments where web console access is not rigorously controlled.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.