CVE-2026-42253: Apache ActiveMQ Header Injection XSS Vulnerability

Technical summary

The MessageServlet in Apache ActiveMQ's web console API exhibits improper input neutralization (CWE-79) when processing JMS message properties. The servlet reflects every property from inbound JMS messages into HTTP response headers without sanitization, normalization, or allowlisting. An attacker with the ability to publish a malicious JMS message containing HTTP header injection payloads can manipulate security-critical headers such as Content-Security-Policy, X-Frame-Options, Set-Cookie, or Location. Since the servlet operates in a web context, injected headers can be leveraged to perform stored or reflected XSS attacks, clickjacking, or credential exfiltration. The vulnerability is network-adjacent (requires message broker access or network path to the broker) but becomes critical when combined with other attack vectors. The fix involves validation of message properties before header serialization and deprecation of the MessageServlet endpoint.

Business impact

Organizations running ActiveMQ web consoles face risk of unauthorized access to broker management interfaces through credential theft via XSS. Attackers exploiting this could redirect administrators to phishing sites, steal session cookies, or inject malware into the management UI. For enterprises using ActiveMQ in production messaging pipelines, compromise of the console could enable lateral movement to backend systems, message interception, or service disruption. The attack surface is primarily internal (requires network access to the web console), but organizations exposing ActiveMQ web interfaces to untrusted networks face heightened risk. Affected deployments should prioritize patching to prevent management plane compromise.

Affected systems

Apache ActiveMQ versions before 5.19.7 are affected. Apache ActiveMQ Web versions before 5.19.7 are affected. Additionally, all ActiveMQ versions from 6.0.0 up to but not including 6.2.6 are vulnerable, as are ActiveMQ Web versions 6.0.0 through 6.2.5. Organizations should check their deployed version against these thresholds. The 5.15.x, 5.16.x, 5.17.x, and 5.18.x series are all impacted if earlier than 5.19.7; the 6.0.x and 6.1.x series are impacted. Verify your exact version in ActiveMQ logs or the web console itself.

Exploitability

Exploitation requires two conditions: (1) network-level access to the ActiveMQ web console or the ability to publish a JMS message to the broker, and (2) a user interaction component—an administrator or operator must view the injected content in the web console. The attack does not require authentication to the broker itself if message publishing is open, but typically occurs in environments where internal access controls exist. The CVSS score of 6.1 reflects the user-interaction requirement and lack of availability impact; however, the XSS vector is high-impact if successfully exploited. Proof-of-concept development is straightforward for a researcher with broker access, but real-world exploitation depends on operational deployment patterns and access controls.

Remediation

Upgrade Apache ActiveMQ to version 5.19.7 or later, or upgrade to version 6.2.6 or later for the 6.x branch. These versions include input validation in the MessageServlet and deprecate the endpoint by default. Organizations unable to patch immediately should restrict network access to the ActiveMQ web console (port 8161 by default) using firewall rules or network segmentation, limit broker message publishing permissions to trusted producers only, and consider disabling the web console if not actively used. After patching, verify the MessageServlet is no longer accessible or that header validation is functioning.

Patch guidance

For ActiveMQ 5.x deployments: upgrade to version 5.19.7 or later. For ActiveMQ 6.x deployments: upgrade to version 6.2.6 or later. Verify against the official Apache ActiveMQ security advisory for exact version numbers and release dates. Test patches in a non-production environment first, particularly if your deployment relies on custom MessageServlet integrations, as the servlet is now deprecated. After upgrading, restart the ActiveMQ service and confirm the web console is operational. Check release notes for any breaking changes or configuration adjustments required.

Detection guidance

Monitor HTTP response headers from the ActiveMQ web console for anomalous or duplicate headers that do not align with expected application behavior. Search web server logs for requests to /admin/msg* or /api/message endpoints combined with header injection payloads (e.g., strings containing newline characters %0d%0a or raw CRLF in JMS message properties). Implement Web Application Firewall (WAF) rules to detect and block header injection attempts. Monitor JMS broker logs for messages containing header-like payloads in their properties. Set up alerts for administrative console access patterns that deviate from baseline, as successful exploitation may result in unusual browser behavior or session anomalies.

Why prioritize this

This vulnerability rates MEDIUM severity (CVSS 6.1) and is not yet listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. Prioritization should be based on deployment context: organizations with internally-segmented networks and restricted console access can defer patching longer, while those exposing ActiveMQ management interfaces or with permissive message publishing policies should patch urgently. The attack requires user interaction but has clear lateral movement potential in compromised environments. Score it relative to your infrastructure—if ActiveMQ is core to production messaging and the web console is accessible, elevate priority to high.

Risk score, explained

The CVSS v3.1 score of 6.1 (MEDIUM) reflects: network-based attack vector (AV:N), low attack complexity (AC:L), no privileges required (PR:N), but required user interaction (UI:R), changed scope (S:C), and limited confidentiality and integrity impact (C:L, I:L) with no availability impact (A:N). The 'changed scope' indicates the vulnerability can affect resources beyond the vulnerable component (other users or services). The score does not fully capture the management-plane compromise risk or lateral movement potential in certain architectures; organizations should contextualize this score against their threat model. If your ActiveMQ console is network-reachable from untrusted sources, consider the effective risk higher than the base score suggests.

Frequently asked questions