Threat reportVulnerabilityTL-2026-0675
Apache ActiveMQ MessageServlet HTTP Response Header Injection (CVE-2026-42253) and Jolokia Default-Permission Privilege Issue (CVE-2026-49157)
Apache ActiveMQ MessageServlet HTTP Response Header (TL-2026-0675) is a high-severity software vulnerability scored CVSS 8.8, first published 2026-06-03. It has no confirmed attribution, affects Apache Software Foundation Apache ActiveMQ (apache-activemq), references 2 CVEs (CVE-2026-42253, CVE-2026-49157), maps to 12 MITRE ATT&CK techniques (T1059, T1068, T1078), and is covered by 9 detection rules and 13 indicators of compromise.
- CVSS
- 8.8/10High
- CVEs
- 2Referenced vulnerabilities
- Techniques
- 12MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 13Indicators of compromise
Key facts for TL-2026-0675
- Threat ID
- TL-2026-0675
- Severity
- HIGH
- CVSS
- 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- NONE
- Motivation
- UNKNOWN
- Target sectors
- technology, financial, telecommunications, government, manufacturing, healthcare, logistics
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 13
How Apache ActiveMQ MessageServlet HTTP Response Header works
Two vendor-confirmed Apache ActiveMQ flaws disclosed end of May 2026. CVE-2026-42253 (CVSS 6.1) lets the web-console MessageServlet copy unsanitized JMS message properties into HTTP response headers, enabling response-header injection/splitting that overrides browser security headers (CSP, X-Frame-Options, HSTS) and enables XSS, session hijacking and clickjacking. CVE-2026-49157 (CVSS 8.8) is an incorrect-default-permissions issue where authenticated low-privilege web users retain Jolokia broker-management capability and can run admin-only operations such as addQueue/removeQueue. Both are fixed in 5.19.7 and 6.2.6.
Apache ActiveMQ Classic shipped two distinct security defects, both published to NVD on 2026-06-01 and fixed in releases 5.19.7 and 6.2.6. They affect different parts of the product (the web-console REST surface and the Jolokia/JMX management authorization layer) and are bundled here because they share the same affected/fixed version ranges, the same disclosure window, and the same exposed attack surface: the ActiveMQ web console.
CVE-2026-42253 (CWE-79, CVSS 6.1 / CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) is a HTTP response header injection in the MessageServlet component of activemq-web. The servlet's setResponseHeaders() method enumerates every JMS message property and writes it verbatim into an HTTP response header: for each property it calls response.setHeader(name, message.getObjectProperty(name).toString()) with no validation or neutralization of the property name or value. An actor who can place a message on a destination that is later retrieved through the web-console message API controls both header names and header values in the servlet's response. Because property values are reflected without CRLF stripping, the flaw permits classic response splitting and, more practically, overwrite/injection of browser security headers. By emitting attacker-chosen Content-Security-Policy, X-Frame-Options or Strict-Transport-Security headers (or removing their protective effect), the attacker can defeat the browser controls that would otherwise contain cross-site scripting and framing, turning the console response into a vehicle for stored/reflected XSS, session-cookie theft and clickjacking against console users. The scope-change (S:C) and UI:R in the vector reflect that exploitation crosses into the victim's browser security context and requires a user to retrieve the poisoned message via the console. The fix deprecates and disables the MessageServlet by default, removing the surface entirely.
CVE-2026-49157 (CWE-276 Incorrect Default Permissions, CVSS 8.8 / CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) stems from the default Jolokia authorization configuration bundled with the ActiveMQ web console. The shipped defaults granted non-admin (low-privilege) web-login accounts access to Jolokia operations that proxy to JMX broker-management MBeans, including administrative operations meant to be restricted to admins such as addQueue and removeQueue. Any authenticated user with a low-privilege web-console login can therefore invoke broker-management operations over the Jolokia exec interface, creating or deleting queues and otherwise manipulating broker state without holding an administrative role. The high confidentiality/integrity/availability impact reflects that JMX/Jolokia broker management exposes substantial control over the messaging fabric: destroying queues disrupts dependent applications, and broker-management access is a strong pivot for further abuse. The fix re-scopes the default Jolokia authorization so management operations require appropriate privilege.
Neither CVE had in-the-wild exploitation or a public weaponized proof-of-concept reported in the source material as of 2026-06-03. However, the MessageServlet mechanism is trivially understood from public source, and both issues are remotely reachable wherever the ActiveMQ web console is exposed. The console should never be Internet-exposed; these flaws raise the impact of an exposed or insufficiently segmented console from information-surface to active browser-security-bypass and authenticated privilege misuse. Defenders should treat any externally reachable ActiveMQ web console (default ports 8161/8162) as the primary exposure and prioritize upgrade plus network restriction.
MITRE ATT&CK techniques used in TL-2026-0675
Execution
T1059 Command and Scripting Interpreter
Privilege Escalation
T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application
Discovery
T1082 System Information Discovery
Collection
T1185 Browser Session Hijacking
Impact
T1485 Data Destruction; T1499 Endpoint Denial of Service; T1565 Data Manipulation
Credential Access
T1539 Steal Web Session Cookie
defense-impairment
Affected products and versions in Apache ActiveMQ MessageServlet HTTP Response Header
- Apache Software Foundation — Apache ActiveMQ (apache-activemq)
Vulnerable versions: < 5.19.7; 6.0.0 - 6.2.5
Fixed in: 5.19.7; 6.2.6 - Apache Software Foundation — Apache ActiveMQ Web (activemq-web)
Vulnerable versions: < 5.19.7; 6.0.0 - 6.2.5
Fixed in: 5.19.7; 6.2.6
Remediation for Apache ActiveMQ MessageServlet HTTP Response Header
Patches
- Upgrade Apache ActiveMQ to 5.19.7 (5.19.x line) or 6.2.6 (6.x line)
- Upgrade the org.apache.activemq:activemq-web component to 5.19.7 or 6.2.6
Immediate actions
- Restrict ActiveMQ web console (default ports 8161/8162) to trusted management networks only; never expose to the Internet
- Block external access to the message REST endpoint (/api/message) and the Jolokia endpoint (/api/jolokia) at the perimeter/reverse proxy
- Audit web-console accounts and remove unnecessary low-privilege logins until Jolokia authorization is re-scoped
Workarounds
- Disable the deprecated MessageServlet if upgrade cannot be performed immediately (it is disabled by default after the fix)
- Manually tighten the Jolokia authorization configuration (jolokia-access.xml / role mapping) so management operations require an admin role
- Remove or disable the web console entirely where it is not operationally required
Longer-term hardening
- Enforce least-privilege RBAC for the web console and require an administrative role for all broker-management operations
- Deploy a reverse proxy / WAF rule set that strips or rejects CRLF and control characters in any response header derived from JMS properties
- Continuously monitor Jolokia exec calls (addQueue/removeQueue and other management MBean operations) and alert on invocation by non-admin principals
- Network-segment messaging middleware so broker management planes are not reachable from user or DMZ networks
CVEs associated with Apache ActiveMQ MessageServlet HTTP Response Header
Weaknesses (CWE) in Apache ActiveMQ MessageServlet HTTP Response Header
Timeline of Apache ActiveMQ MessageServlet HTTP Response Header
- CVE-2026-49157 (Jolokia default-permission broker-management issue) disclosed publicly via the oss-security mailing list, credited to Leon Johnson (lokerxx).
- Apache ActiveMQ Classic security advisories published for both CVEs, crediting Vishal Shukla, pyn3rd, uname, 4ra1n and kikayli for CVE-2026-42253.
- Apache Software Foundation released fixed versions 5.19.7 and 6.2.6; MessageServlet deprecated and disabled by default, Jolokia default authorization re-scoped.
- Both CVE-2026-42253 (CVSS 6.1, CWE-79) and CVE-2026-49157 (CVSS 8.8, CWE-276) published to the NVD.
- Threadlinqs began tracking TL-2026-0675; no in-the-wild exploitation and no public weaponized PoC observed as of this date.
- Cyber Security News published analysis of CVE-2026-42253 highlighting the security-header-injection / browser-control-bypass impact.
Sources cited for Apache ActiveMQ MessageServlet HTTP Response Header
- Critical Apache ActiveMQ Vulnerability Allows Malicious Security Header Injections
- Apache ActiveMQ Classic Security Advisories
- CVE-2026-42253 Apache advisory announcement (HTTP Response Header Injection via JMS Message Properties)
- CVE-2026-49157 Apache advisory announcement (Authenticated low-privilege Web users retain Jolokia broker-management capability by default)
- NVD - CVE-2026-42253
- NVD - CVE-2026-49157
- oss-security: CVE-2026-49157 Apache ActiveMQ Jolokia broker-management disclosure
- apache/activemq MessageServlet.java (vulnerable setResponseHeaders source)
Detection coverage for TL-2026-0675
As of 2026-06-03, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0675 across Splunk SPL, Microsoft KQL and Sigma, covering 13 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.