CVE-2026-52760: Apache ActiveMQ Web Console Stored XSS via Message ID Injection

Technical summary

The vulnerability is an improper input neutralization flaw (CWE-79) in the Web Console's queue browse functionality. The message ID field is rendered directly into the page without HTML sanitization or encoding. Because message IDs are user-controllable by any authenticated producer, an attacker can inject script tags or event handlers. The resulting stored XSS executes in the context of the administrator's session when they view the affected queue. The CVSS 3.1 score of 6.1 (Medium) reflects network accessibility, low attack complexity, and the requirement for user interaction (administrator browsing), balanced against the attack requiring prior authentication and limiting impact to confidentiality and integrity of the console session.

Business impact

Administrators of ActiveMQ deployments face elevated risk when managing queues. A compromised or malicious producer account can execute arbitrary JavaScript in administrator browsers, potentially leading to unauthorized configuration changes, message manipulation, credential theft, or lateral movement into downstream systems. In environments where ActiveMQ manages critical workflows (payment processing, order fulfillment, logging), this could disrupt operations or enable data exfiltration. Organizations with strict separation between producer and administrator roles face reduced but non-zero risk.

Affected systems

Apache ActiveMQ versions before 5.19.8 and versions 6.0.0 through 6.2.6 are affected. The Web Console component is the attack vector, so deployments must have the Web Console enabled and in use. Organizations running 5.19.8, 6.2.7, or later are not vulnerable. Verify your deployed version via the ActiveMQ startup logs or the Web Console 'About' page.

Exploitability

Exploitation requires two conditions: (1) the attacker must have valid producer credentials to send messages to a queue, and (2) an administrator must browse that queue in the Web Console. The attack is not remotely triggerable by unauthenticated users. However, many organizations operate with shared or overly permissive producer credentials, and queue browsing is routine administrative work. The payload delivery is deterministic once those conditions are met. No public exploit code has been indexed in CISA's KEV catalog, but the mechanics are straightforward for threat actors with internal access or compromised producer accounts.

Remediation

Upgrade Apache ActiveMQ to version 5.19.8 or 6.2.7 (or later). Both branches receive the fix. If immediate patching is not feasible, restrict Web Console access to trusted networks only (firewall rules, VPN), limit producer account permissions to only required queues, and monitor for suspicious message IDs or unusual queue browsing patterns. Do not rely solely on input validation at the application layer without upgrading, as defense-in-depth requires the vendor fix.

Patch guidance

Apache ActiveMQ patch versions 5.19.8 and 6.2.7 address this vulnerability. Verify against the official Apache ActiveMQ release notes and security advisories to confirm your target version. Test patches in a non-production environment first, as ActiveMQ updates may require connection string or configuration adjustments depending on your deployment model (embedded, standalone broker, clustered). If you are on a version between 6.0.0 and 6.2.6, plan an upgrade to 6.2.7. If you are on 5.x before 5.19.8, upgrade to 5.19.8 or migrate to the 6.x branch if feasible.

Detection guidance

Monitor Web Console access logs for repeated queue browse operations, especially from unusual accounts or at odd hours. Inspect JMS message IDs in logs or via queue introspection for HTML tags, script keywords, event handlers (onclick, onload), or URL schemes (javascript:, data:). Network monitoring between producers and brokers can flag oversized or malformed message ID fields. Intrusion detection rules can match on payloads containing script tags in message headers. Consider enabling audit logging on your ActiveMQ broker to capture queue operations by user and timestamp.

Why prioritize this

Although the CVSS score is Medium (6.1), prioritize patching because: (1) the attack targets administrative users, who often have elevated system access and trust; (2) XSS in management consoles frequently leads to account takeover or configuration tampering; (3) the vulnerability is in widely deployed infrastructure (ActiveMQ is common in enterprise messaging); (4) the patch is non-disruptive and vendor-supported. Prioritize organizations with public-facing or untrusted producer populations higher than those with strictly internal, vetted producers.

Risk score, explained

The CVSS 3.1 score of 6.1 reflects: Attack Vector (Network) and low Attack Complexity indicate easy exploitation given access; Privileges Required (None in the vector, but contextually producer auth is required) and User Interaction (Required—admin must browse) reduce likelihood; Scope (Changed) elevates impact because the XSS affects the admin's broader browser session; and Confidentiality + Integrity (Low) capture session hijacking and console manipulation without full system compromise. The score does not account for the administrative privilege escalation that often follows successful XSS in management interfaces, so real-world impact may exceed the CVSS baseline.

Frequently asked questions