CVE-2026-41043: Apache ActiveMQ, Apache ActiveMQ Web: ActiveMQ Web Console - XSS vulnerability when browsing queues
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache ActiveMQ, Apache ActiveMQ Web.
An authenticated attacker can show malicious content when browsing queues in the web console by overriding the content type to be HTML (instead of XML) and by injecting HTML into a JMS selector field.
This issue affects Apache ActiveMQ: before 5.19.6, from 6.0.0 before 6.2.5; Apache ActiveMQ Web: before 5.19.6, from 6.0.0 before 6.2.5.
Users are recommended to upgrade to version 6.2.5 or 5.19.6, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache ActiveMQto a version that resolves this vulnerability.Fixed in 6.2.5 - Upgrade
Upgrade
Apache ActiveMQto a version that resolves this vulnerability.Fixed in 5.19.6 - Upgrade
Upgrade
Apache ActiveMQ Webto a version that resolves this vulnerability.Fixed in 6.2.5 - Upgrade
Upgrade
Apache ActiveMQ Webto a version that resolves this vulnerability.Fixed in 5.19.6 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch CVE-2026-41043
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41043?
CVE-2026-41043 is classified as a medium severity Cross-Site Scripting (XSS) vulnerability.
How do I fix CVE-2026-41043?
To fix CVE-2026-41043, upgrade to Apache ActiveMQ version 5.19.7 or later, or 6.2.6 or later.
Who is affected by CVE-2026-41043?
CVE-2026-41043 affects Apache ActiveMQ and ActiveMQ Web versions prior to 5.19.7 and 6.2.6.
What type of vulnerability is CVE-2026-41043?
CVE-2026-41043 is a Cross-Site Scripting (XSS) vulnerability affecting the ActiveMQ Web Console.
Can an unauthenticated user exploit CVE-2026-41043?
No, CVE-2026-41043 requires an attacker to be authenticated to exploit the XSS vulnerability.