CVE-2026-40466

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-40466
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40466.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-40466
Aliases
Downstream
Related
Published
2026-04-24T10:15:44.445Z
Modified
2026-07-08T08:13:12.834233668Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Possible bypass of CVE-2026-34197 via HTTP discovery second-stage URI
Details

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ.

An authenticated attacker may bypass the fix in CVE-2026-34197 by adding a connector using an HTTP Discovery transport via BrokerView.addNetworkConnector or BrokerView.addConnector through Jolokia if the activemq-http module is on the classpath. A malicious HTTP endpoint can return a VM transport through the HTTP URI which will bypass the validation added in CVE-2026-34197. The attacker can then use the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec().

This issue affects Apache ActiveMQ Broker: before 5.19.6, from 6.0.0 before 6.2.5; Apache ActiveMQ All: before 5.19.6, from 6.0.0 before 6.2.5; Apache ActiveMQ: before 5.19.6, from 6.0.0 before 6.2.5.

Users are recommended to upgrade to version 5.19.6 or 6.2.5, which fixes the issue.

Database specific 
{
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "fixed": "5.19.6"
                },
                {
                    "introduced": "6.0.0"
                },
                {
                    "fixed": "6.2.5"
                },
                {
                    "fixed": "5.19.6"
                },
                {
                    "introduced": "6.0.0"
                },
                {
                    "fixed": "6.2.5"
                },
                {
                    "fixed": "5.19.6"
                },
                {
                    "introduced": "6.0.0"
                },
                {
                    "fixed": "6.2.5"
                }
            ]
        },
        {
            "source": "DESCRIPTION",
            "extracted_events": [
                {
                    "fixed": "5.19.6"
                },
                {
                    "introduced": "6.0.0"
                },
                {
                    "fixed": "6.2.5"
                },
                {
                    "fixed": "5.19.6"
                },
                {
                    "introduced": "6.0.0"
                },
                {
                    "fixed": "6.2.5"
                },
                {
                    "fixed": "5.19.6"
                },
                {
                    "introduced": "6.0.0"
                },
                {
                    "fixed": "6.2.5"
                }
            ]
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40466.json",
    "cna_assigner": "apache",
    "cwe_ids": [
        "CWE-20",
        "CWE-94"
    ]
}
References

Affected packages

Git / github.com/apache/activemq

Affected ranges

Type
GIT
Repo
https://github.com/apache/activemq
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
cf52dd245cd2ae93d81668bbd472ac995bf25f69
Introduced
14bac13f40958c1a1d3d198051eed32facc4abd1
Fixed
cfa799820a577f819b2dfd8e49341b1084a358b9
Database specific 
{
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "5.19.6"
        },
        {
            "introduced": "6.0.0"
        },
        {
            "fixed": "6.2.5"
        }
    ]
}

Affected versions

activemq-5.*
activemq-5.10.0
activemq-5.11.0
activemq-5.12.0
activemq-5.13.0
activemq-5.14.0
activemq-5.15.0
activemq-5.16.0
activemq-5.18.0
activemq-5.18.1
activemq-5.18.2
activemq-5.18.3
activemq-5.18.4
activemq-5.18.5
activemq-5.18.6
activemq-5.19.0
activemq-5.19.1
activemq-5.19.2
activemq-5.9.0
activemq-6.*
activemq-6.0.0
activemq-6.1.0
activemq-6.1.1
activemq-6.1.2
activemq-6.2.0
activemq-6.2.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40466.json"