Claude Discovers Apache ActiveMQ Bug Hidden for 13 Years
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-32114 | In Apache ActiveMQ 6.x, the default configuration doesn't secure the API web context (where the Jolokia JMX REST API and the Message REST API are located). In Apache ActiveMQ 6.x, the default configuration doesn't secure the API web context (where the Jolokia JMX REST API and the Message REST API are located). It means that anyone can use these layers without any required authentication. Potentially, anyone can interact with the broker (using Jolokia JMX REST API) and/or produce/consume messages or purge/delete destinations (using the Message REST API). To mitigate, users can update the default conf/jetty.xml configuration file to add authentication requirement: Or we encourage users to upgrade to Apache ActiveMQ 6.1.2 where the default configuration has been updated with authentication by default. NVD description · AI analysis pending | 8.8 | 7% |
| — | ||
| CVE-2026-34197 | Authenticated RCE in Apache ActiveMQ via Jolokia JMX-HTTP Bridge Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on its web console, and the default Jolokia access policy allows authenticated users to invoke exec operations on all ActiveMQ MBeans, including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). An authenticated attacker abuses these operations with a crafted discovery URI so that the VM transport's brokerConfig parameter loads a remote Spring XML application context; because ResourceXmlApplicationContext instantiates singleton beans before the BrokerService validates the configuration, arbitrary code runs in the broker's JVM (e.g., through Runtime.exec() bean factory methods), yielding code execution with the broker's privileges. Affected users are those running Apache ActiveMQ Broker, ActiveMQ All, or ActiveMQ (Classic) on versions before 5.19.4 or 6.x versions from 6.0.0 before 6.2.3. Authentication to the web console is required (CVSS privileges-required: low), but CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-04-16 amid reported active exploitation, and EPSS puts 30-day exploitation probability at 98.3%. No public proof-of-concept is known, and whether ransomware groups are using it is unknown. Do: Upgrade Apache ActiveMQ to 5.19.4 (5.x line) or 6.2.3 (6.x line), which fix the issue; federal agencies must apply mitigations under BOD 22-01 timelines. As interim mitigation, restrict access to the web console /api/jolokia/ endpoint, tighten the Jolokia access policy so exec is not permitted on org.apache.activemq:* MBeans (especially BrokerService.addNetworkConnector/addConnector), and enforce strong authentication. Review broker logs for Jolokia calls to these operations and for unexpected VM-transport connector additions. | 8.8 | 98% | KEV |
| large≈10,000–100,000 exposed systems, plausibly 100,000+ installations overall (public scans typically show tens of thousands of ActiveMQ web consoles;… |
Full article431 words · extracted from infosecurity-magazine.com · click to collapse
An AI-powered vulnerability-hunting effort helped security researchers discover a flaw in Apache ActiveMQ Classic that they claim was “hiding in plain sight” for over a decade.
Horizon3.ai chief architect, Naveen Sunkavally, explained in a blog post, published on April 7, that remote code execution (RCE) bug CVE-2026-34197 should be treated as a high priority for organizations running the open source message broker.
“An attacker can invoke a management operation through ActiveMQ’s Jolokia API to trick the broker into fetching a remote configuration file and running arbitrary OS commands,” he explained.
“The vulnerability requires credentials, but default credentials (admin:admin) are common in many environments. On some versions (6.0.0-6.1.1), no credentials are required at all due to another vulnerability, CVE-2024-32114, which inadvertently exposes the Jolokia API without authentication. In those versions, CVE-2026-34197 is effectively an unauthenticated RCE.”
CVE-2026-34197 was patched in ActiveMQ Classic versions 5.19.4 and 6.2.3, so it’s recommended that users update and ensure no default credentials are in use.
Organizations concerned they may have been compromised via the RCE bug should look in their ActiveMQ broker logs for network connector activity referencing vm:// URIs with brokerConfig=xbean:http.
Other indicators of compromise include:
- POST requests to /api/jolokia/ containing addNetworkConnector in the request body
- Outbound HTTP requests from the ActiveMQ broker process to unexpected hosts
- Unexpected child processes spawned by the ActiveMQ Java process
AI Finds the Flaw
The discovery of CVE-2026-34197 was “80% Claude,” Anthropic's AI and “20% gift-wrapping by a human,” Sunkavally explained.
“These days I always use Claude to take a first pass at source code for vulnerability hunting. I prompt it lightly and set up a target on the network for it to validate findings,” he said.
“A lot of the time, Claude finds interesting stuff but it doesn’t quite rise to the level of a CVE I’d bother reporting. In this case, it did a great job, with nothing more than a couple of basic prompts.”
The flaw had lain hidden for 13 years partly because it involved multiple components developed independently over that time, Sunkavally said. In isolation, each feature looked fine, but they became dangerous when chained together.
“This is exactly where Claude shone – efficiently stitching together this path end to end with a clear head free of assumptions,” he continued. “Something that would have probably taken me a week manually took Claude 10 minutes.”
Sunkavally urged appsec engineers and developers to use tools like Claude in their work, claiming that “anyone with a security background can take advantage.”
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/claude-apache-activemq-bug-hidden/