apache-activemq-rce-research

Apache ActiveMQ Classic — RCE Research Private research archive for the Apache ActiveMQ Classic Jolokia → addNetworkConnector → xbean/Spring-XML remote-code-execution chain CVE-2026-34197 and its patch-bypass CVE-2026-42588, plus a full auto-research audit of the fixed 6.2.6 release and a...

CVE-2026-34197

CVE-2026-34197 CVE-2026-34197 activemq PoC PoC for the ActiveMQ as per Horizon3 post https://horizon3.ai/attack-research/disclosures/cve-2026-34197-activemq-rce-jolokia/ krasn@icestorm cve-2026-34197-activemq % docker compose up -d krasn@icestorm cve-2026-34197-activemq % python3 exploitpoc.py au...

CVE-2026-42588

CVE-2026-42588 - Apache ActiveMQ Jolokia Remote Code Execution Exploit Severity : 🔴 High CVSS 4.0: 8.1 Vulnerability Type : CWE-94 — Code Injection Affected Versions : Apache ActiveMQ Prerequisites : Requires Web Console authentication credentials default admin:admin 📋 Table of Contents...

CVE-2022-41678

CVE-2022-41678: Dangerous MBeans Accessible via Jolokia API in Apache ActiveMQ By listing and inspecting the MBeans exposed by the Jolokia API at http://127.0.0.1:8161/api/jolokia the following attack vectors have been identified: Arbitrary File Write using Log4J resulting in Remote Code Executio...

Apache ActiveMQ - Remote Code Execution

Improper Input Validation, Improper Control of Generation of Code 'Code Injection' vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations o...

Apache ActiveMQ - Remote Code Execution via HTTP Discovery Transport Bypass

Apache ActiveMQ before 5.19.6 and 6.0.0 through 6.2.4 is vulnerable to remote code execution via a bypass of the CVE-2026-34197 security fix. The original fix blocked the "vm://" transport scheme in BrokerView.addNetworkConnector and BrokerView.addConnector to prevent authenticated attackers from...

rhuss__jolokia_CVE-2018-1000129_1-4-0

Jolokia is a fresh way to access JMX MBeans remotely. It is different from JSR-160 connectors in that it is an agent-based approach which uses JSON over HTTP for its communication in a REST-stylish way. Multiple agents are provided for different environments: WAR Agent for deployment as web...

CVE-2026-34197

🚨 CVE-2026-34197 — Critical Jolokia RCE in Apache ActiveMQ Authenticated RCE via Jolokia MBeans → Remote Spring XML → JVM Code Execution 📖 Overview CVE-2026-34197 is a high-severity authenticated remote code execution vulnerability affecting Apache ActiveMQ Classic. The issue exists in the Joloki...

CVE-2026-34197-PoC

CVE-2026-34197 — Apache ActiveMQ Jolokia addNetworkConnector RCE Proof-of-concept and technical notes for CVE-2026-34197 , a remote code execution vulnerability in Apache ActiveMQ Classic reachable through the Jolokia JMX-HTTP bridge. Affected: ActiveMQ Classic ⚠️ For authorized testing / research...

CVE-2026-34197

CVE-2026-34197 ActiveMQ Classic Security Detection Tool This is an Apache ActiveMQ Classic exposure detection tool for defense and internal network reconnaissance, used to assist in assessing risks related to CVE-2026-34197. This project does not contain exploit code, does not execute Jolokia exe...

CVE-2026-34197

CVE-2026-34197 — Apache ActiveMQ Classic RCE via Jolokia API TL;DR A remote code execution vulnerability in Apache ActiveMQ Classic that allows an attacker to execute arbitrary code by invoking the addNetworkConnectorString MBean operation through the Jolokia API /api/jolokia/. The attacker embed...

CVE-2026-34197

CVE-2026-34197 Description Improper Input Validation, Improper Control of Generation of Code ‘Code Injection’ vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access polic...

Jolokia Agent - JNDI Code Injection

Jolokia agent is vulnerable to a JNDI injection vulnerability that allows a remote attacker to run arbitrary Java code on the server when the agent is in proxy mode. id: CVE-2018-1000130 info: name: Jolokia Agent - JNDI Code Injection author: milo2012 severity: high description: | Jolokia agent i...

Jolokia 1.3.7 - Cross-Site Scripting

Jolokia 1.3.7 is vulnerable to cross-site scripting in the HTTP servlet and allows an attacker to execute malicious JavaScript in the victim's browser. id: CVE-2018-1000129 info: name: Jolokia 1.3.7 - Cross-Site Scripting author: mavericknerd,0h1in9e,daffainfo severity: medium description: |...

CVE-2026-34197

CVE-2026-34197 - Apache ActiveMQ RCE via Jolokia 1. Overview Item| Details ---|--- CVE ID| CVE-2026-34197 CVSS| 8.8 HIGH Vulnerability Type| Remote Code Execution RCE CWE| CWE-20 Improper Input Validation / CWE-94 Code Injection Affected Component| Apache ActiveMQ Classic - Jolokia JMX-HTTP Bridg...

CVE-2026-34197-Lab

CVE-2026-34197 — Apache ActiveMQ Classic Jolokia RCE Lab Overview This repository is a local Docker lab for studying CVE-2026-34197 , an Apache ActiveMQ Classic remote code execution issue reachable through the Jolokia JMX-HTTP API. The lab compares two ActiveMQ Classic instances side by side:...

CVE-2026-34197

CVE-2026-34197 Apache ActiveMQ Remote Code Execution via Jolokia API Overview • Details...

CVE-2026-34197-payload-Apache-ActiveMQ-

ActiveMQ Jolokia RCE Vulnerability Reproduction Guide This repository provides a remote code execution RCE vulnerability reproduction environment and exploitation script based on the exposed Jolokia API endpoint /api/jolokia/ of Apache ActiveMQ. By invoking the addNetworkConnector operation, it...

CVE-2023-50780

CVE-2023-50780: Dangerous MBeans Accessible via Jolokia API in Apache ActiveMQ Artemis By listing and inspecting the MBeans exposed by the Jolokia API at http://127.0.0.1:8161/console/jolokia the following attack vectors have been identified: Arbitrary File Write using Log4J indirectly resulting ...

CVE-2026-34197

CVE-2026-34197 — Apache ActiveMQ RCE via Jolokia API Description CVE-2026-34197 is a remote code execution RCE vulnerability in Apache ActiveMQ Classic that allows an attacker to execute arbitrary commands on the server's operating system through the Jolokia API exposed on the web console. The...