CVE-2026-34197

Apache ActiveMQ Improper Input Validation Vulnerability

Activemq

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). An authenticated attacker can invoke…

7. Apr 2026

Ausgewertete Quellen

• Red Hat
  https://access.redhat.com/security/cve/CVE-2026-34197
• Red Hat
  https://bugzilla.redhat.com/show_bug.cgi?id=2455869
• Red Hat
  https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34197.json
• Hersteller
  https://activemq.apache.org/security-advisories.data/CVE-2026-34197-announcement.txt
• Hinweis
  http://www.openwall.com/lists/oss-security/2026/04/06/3
• CISA
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34197
• CISA
  Apache ActiveMQ Improper Input Validation Vulnerability
• NVD
  CVE-2026-34197