# Apache ActiveMQ MessageServlet HTTP Response Header Injection (CVE-2026-42253) and Jolokia Default-Permission Privilege Issue (CVE-2026-49157)

> Two vendor-confirmed Apache ActiveMQ flaws disclosed end of May 2026. CVE-2026-42253 (CVSS 6.1) lets the web-console MessageServlet copy unsanitized JMS message properties into HTTP response headers, enabling response-header injection/splitting that overrides browser security headers (CSP, X-Frame-Options, HSTS) and enables XSS, session hijacking and clickjacking. CVE-2026-49157 (CVSS 8.8) is an incorrect-default-permissions issue where authenticated low-privilege web users retain Jolokia broker-management capability and can run admin-only operations such as addQueue/removeQueue. Both are fixed in 5.19.7 and 6.2.6.

- **Published:** 2026-06-03T00:00:00Z
- **Last reviewed:** 2026-06-03T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0675
- **ID:** TL-2026-0675
- **Severity:** HIGH (CVSS 8.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 13 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-42253, CVE-2026-49157

## Description

Apache ActiveMQ Classic shipped two distinct security defects, both published to NVD on 2026-06-01 and fixed in releases 5.19.7 and 6.2.6. They affect different parts of the product (the web-console REST surface and the Jolokia/JMX management authorization layer) and are bundled here because they share the same affected/fixed version ranges, the same disclosure window, and the same exposed attack surface: the ActiveMQ web console.

CVE-2026-42253 (CWE-79, CVSS 6.1 / CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) is a HTTP response header injection in the MessageServlet component of activemq-web. The servlet's setResponseHeaders() method enumerates every JMS message property and writes it verbatim into an HTTP response header: for each property it calls response.setHeader(name, message.getObjectProperty(name).toString()) with no validation or neutralization of the property name or value. An actor who can place a message on a destination that is later retrieved through the web-console message API controls both header names and header values in the servlet's response. Because property values are reflected without CRLF stripping, the flaw permits classic response splitting and, more practically, overwrite/injection of browser security headers. By emitting attacker-chosen Content-Security-Policy, X-Frame-Options or Strict-Transport-Security headers (or removing their protective effect), the attacker can defeat the browser controls that would otherwise contain cross-site scripting and framing, turning the console response into a vehicle for stored/reflected XSS, session-cookie theft and clickjacking against console users. The scope-change (S:C) and UI:R in the vector reflect that exploitation crosses into the victim's browser security context and requires a user to retrieve the poisoned message via the console. The fix deprecates and disables the MessageServlet by default, removing the surface entirely.

CVE-2026-49157 (CWE-276 Incorrect Default Permissions, CVSS 8.8 / CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) stems from the default Jolokia authorization configuration bundled with the ActiveMQ web console. The shipped defaults granted non-admin (low-privilege) web-login accounts access to Jolokia operations that proxy to JMX broker-management MBeans, including administrative operations meant to be restricted to admins such as addQueue and removeQueue. Any authenticated user with a low-privilege web-console login can therefore invoke broker-management operations over the Jolokia exec interface, creating or deleting queues and otherwise manipulating broker state without holding an administrative role. The high confidentiality/integrity/availability impact reflects that JMX/Jolokia broker management exposes substantial control over the messaging fabric: destroying queues disrupts dependent applications, and broker-management access is a strong pivot for further abuse. The fix re-scopes the default Jolokia authorization so management operations require appropriate privilege.

Neither CVE had in-the-wild exploitation or a public weaponized proof-of-concept reported in the source material as of 2026-06-03. However, the MessageServlet mechanism is trivially understood from public source, and both issues are remotely reachable wherever the ActiveMQ web console is exposed. The console should never be Internet-exposed; these flaws raise the impact of an exposed or insufficiently segmented console from information-surface to active browser-security-bypass and authenticated privilege misuse. Defenders should treat any externally reachable ActiveMQ web console (default ports 8161/8162) as the primary exposure and prioritize upgrade plus network restriction.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1068 Exploitation for Privilege Escalation
- T1548 Abuse Elevation Control Mechanism
- T1685 Disable or Modify Tools
- T1539 Steal Web Session Cookie
- T1082 System Information Discovery
- T1185 Browser Session Hijacking
- T1565 Data Manipulation
- T1499 Endpoint Denial of Service
- T1485 Data Destruction

## Sources

- [Critical Apache ActiveMQ Vulnerability Allows Malicious Security Header Injections](https://cybersecuritynews.com/apache-activemq-header-injection-vulnerability/)
- [Apache ActiveMQ Classic Security Advisories](https://activemq.apache.org/components/classic/security)
- [CVE-2026-42253 Apache advisory announcement (HTTP Response Header Injection via JMS Message Properties)](https://activemq.apache.org/security-advisories.data/CVE-2026-42253-announcement.txt)
- [CVE-2026-49157 Apache advisory announcement (Authenticated low-privilege Web users retain Jolokia broker-management capability by default)](https://activemq.apache.org/security-advisories.data/CVE-2026-49157-announcement.txt)
- [NVD - CVE-2026-42253](https://nvd.nist.gov/vuln/detail/CVE-2026-42253)
- [NVD - CVE-2026-49157](https://nvd.nist.gov/vuln/detail/CVE-2026-49157)
- [oss-security: CVE-2026-49157 Apache ActiveMQ Jolokia broker-management disclosure](https://www.openwall.com/lists/oss-security/2026/05/31/21)
- [apache/activemq MessageServlet.java (vulnerable setResponseHeaders source)](https://github.com/apache/activemq/blob/main/activemq-web/src/main/java/org/apache/activemq/web/MessageServlet.java)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0675