{"id":"CVE-2026-52760","kind":"vulnerability","aliases":["CVE-2026-52760","GHSA-j548-68g5-9j7x"],"related":[],"title":"Apache ActiveMQ, Apache ActiveMQ Web Console vulnerable to Cross-site Scripting","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache ActiveMQ, Apache ActiveMQ Web Console.\n\nThe browse page in the web console renders a message Id directly without sanitization. This allows an authenticated producer to send a message with a JMS message ID that has been crafted to contain HTML/JavaScript such that when an administrator browses the queue in the Web Console, the payload executes in their browser.\nThis issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ Web Console: before 5.19.8, from 6.0.0 before 6.2.7.\n\nUsers are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.","summary":"The ActiveMQ web console's browse page renders a JMS message ID without sanitization. An authenticated producer can send a message whose ID contains script, which runs in an administrator's browser when they browse the queue.","severity":"medium","cvss":6.1,"epss":0.00679,"exploited":false,"exploited_at":null,"products":[{"name":"org.apache.activemq:apache-activemq","fixed":["5.19.8"],"affected":"< 5.19.8","ecosystem":"maven"},{"name":"org.apache.activemq:apache-activemq","fixed":["6.2.7"],"affected":">= 6.0.0, < 6.2.7","ecosystem":"maven"},{"name":"org.apache.activemq:activemq-web-console","fixed":["5.19.8"],"affected":"< 5.19.8","ecosystem":"maven"},{"name":"org.apache.activemq:activemq-web-console","fixed":["6.2.7"],"affected":">= 6.0.0, < 6.2.7","ecosystem":"maven"},{"name":"apache activemq","fixed":["5.19.8"],"affected":"< 5.19.8","ecosystem":"vendor"},{"name":"apache activemq","fixed":["6.2.7"],"affected":">= 6.0.0, < 6.2.7","ecosystem":"vendor"},{"name":"apache activemq web","fixed":["5.19.8"],"affected":"< 5.19.8","ecosystem":"vendor"},{"name":"apache activemq web","fixed":["6.2.7"],"affected":">= 6.0.0, < 6.2.7","ecosystem":"vendor"}],"ecosystems":["maven","vendor"],"tags":["activemq","cwe-79","java","maven","message-broker","package"],"not_affected_if":["fixed-version","no-untrusted-producers","no-web-console"],"how_to_check":"- Check the ActiveMQ version the broker runs; affected builds are `5.19.8` and earlier and `6.0.0` up to but not including `6.2.7`.\n- Check whether the web console (activemq-web-console) is deployed on the broker.","fix":"- Apache ActiveMQ: upgrade to `5.19.8` on the 5.x line or `6.2.7` on the 6.x line.\n- Apache ActiveMQ Web Console: upgrade to `5.19.8` on the 5.x line or `6.2.7` on the 6.x line.","status":"open","published_at":"2026-06-30T11:16:30+00:00","first_seen_at":"2026-11-05T17:38:59+00:00","triaged_at":"2026-11-05T17:40:01+00:00","updated_at":"2026-11-05T17:40:05+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-05T17:40:01Z","model":"claude-haiku-5-5","output":{"fix":"- Apache ActiveMQ: upgrade to `5.19.8` on the 5.x line or `6.2.7` on the 6.x line.\n- Apache ActiveMQ Web Console: upgrade to `5.19.8` on the 5.x line or `6.2.7` on the 6.x line.","reach":"network","title":"Apache ActiveMQ web console: stored XSS via crafted message ID","impact":"medium","summary":"The ActiveMQ web console's browse page renders a JMS message ID without sanitization. An authenticated producer can send a message whose ID contains script, which runs in an administrator's browser when they browse the queue.","audience":"businesses","category":"package","nicknames":[],"who_cares":["activemq","java","message-broker","maven"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"script runs in an administrator's browser session in the console","analyst_note":"","how_to_check":"- Check the ActiveMQ version the broker runs; affected builds are `5.19.8` and earlier and `6.0.0` up to but not including `6.2.7`.\n- Check whether the web console (activemq-web-console) is deployed on the broker.","plain_action":"","needs_analyst":false,"not_affected_if":["fixed-version","no-web-console","no-untrusted-producers"],"who_is_affected":"Teams that run Apache ActiveMQ with its web console enabled are exposed. The attacker must be able to send messages as an authenticated producer, and an administrator must then browse the affected queue in the console. Brokers on the fixed versions, or without the web console, can skip it.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000765,"input_tokens":4671,"output_tokens":596,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,22A '-52760':15A,23A '-79':54B '5.19.8':177C,187C,201C '6.0.0':179C,189C '6.2.7':181C,191C,199C '68g5':19A '9j7x':20A 'activemq':2A,4A,27A,31A,34A,39A,43A,45A,47A,50A,52B,62B,113C,115C,175C,183C 'activemq-web-console':33A,38A 'administr':90B,157C 'affect':173C 'allow':133C 'apach':1A,3A,112C,114C,174C,182C 'apache':26A,30A,42A,44A,46A,49A 'apache-activemq':25A,29A 'authent':76B,135C 'broker':59B 'brows':66B,95B,119C,158C 'browser':92B,170C 'consol':6A,64B,117C,124C,164C,185C 'console':36A,41A 'contain':84B,151C 'craft':149C 'cross':10A,107C 'cross-sit':9A,106C 'cve':13A,21A 'cwe':53B 'direct':129C 'execut':167C 'fix':203C 'generat':105C 'ghsa':17A 'ghsa-j548-68g5-9j7x':16A 'html/javascript':152C 'id':72B,83B,128C,145C 'improp':98C 'input':101C 'issu':172C,205C 'j548':18A 'java':55B 'jms':70B,143C 'maven':56B 'messag':58B,71B,81B,127C,140C,144C 'message-brok':57B 'neutral':99C 'org.apache.activemq':24A,28A,32A,37A 'packag':60B 'page':67B,104C,120C 'payload':166C 'produc':77B,136C 'queue':97B,160C 'recommend':194C 'render':68B,125C 'run':87B 'sanit':74B,131C 'script':12A,85B,109C 'send':79B,138C 'site':11A,108C 'upgrad':196C 'user':192C 'version':198C 'vulner':7A,110C 'web':5A,35A,40A,48A,51A,63B,103C,116C,123C,163C,184C 'whose':82B 'without':73B,130C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Apache ActiveMQ with its web console enabled are exposed. The attacker must be able to send messages as an authenticated producer, and an administrator must then browse the affected queue in the console. Brokers on the fixed versions, or without the web console, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["activemq","activemqweb","apacheactivemq","apacheactivemqweb","orgapacheactivemqactivemqwebconsole","orgapacheactivemqapacheactivemq"],"ptokens":["activemq","apache","console","org","web"],"labels":["activemq","cwe79","java","maven","medium","messagebroker","package","vendor"],"campaign_type":null,"first_public_at":"2026-06-30T11:16:30+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-j548-68g5-9j7x","url":"https://github.com/advisories/GHSA-j548-68g5-9j7x","severity":"medium","published_at":"2026-06-30T12:31:52+00:00","modified_at":"2026-11-05T17:35:07+00:00","first_seen_at":"2026-11-05T17:38:59+00:00","fetched_at":"2026-11-05T17:46:22+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-52760","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52760","severity":null,"published_at":"2026-06-30T11:16:30+00:00","modified_at":"2026-07-02T18:42:09+00:00","first_seen_at":"2026-11-05T17:40:05+00:00","fetched_at":"2026-11-05T17:40:05+00:00","note":null}],"documents":[{"id":78059,"url":"https://github.com/apache/activemq/pull/2089","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":78060,"url":"https://github.com/apache/activemq/commit/1cbe5ab1122e299852b821ba33e7abd0cd76f77c","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":78061,"url":"https://github.com/apache/activemq/commit/90c509f49b88fa71a55020e7ebb5d7264d7804e9","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":78062,"url":"https://github.com/apache/activemq/commit/ea5a33ce87a203e0c8335f46f976e0a29c90f18a","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":68016,"url":"https://github.com/apache/activemq/releases/tag/activemq-5.19.8","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"},{"id":68017,"url":"https://github.com/apache/activemq/releases/tag/activemq-6.2.7","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"},{"id":78151,"url":"https://lists.apache.org/thread/d3mhyo2116nomz2lwxppyy4pclvdxq3n","title":"Vendor advisory: lists.apache.org","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: lists.apache.org"},{"id":78152,"url":"http://www.openwall.com/lists/oss-security/2026/06/29/12","title":"Third-party advisory: www.openwall.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.openwall.com"}],"exploit_sources":[{"type":"epss","score":0.00679,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-52760"}],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}