CVE-2026-52760: Apache ActiveMQ, Apache ActiveMQ Web Console: Stored XSS via Unescaped values in ActiveMQ Web Console
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache ActiveMQ, Apache ActiveMQ Web Console.
The browse page in the web console renders a message Id directly without sanitization. This allows an authenticated producer to send a message with a JMS message ID that has been crafted to contain HTML/JavaScript such that when an administrator browses the queue in the Web Console, the payload executes in their browser. This issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ Web Console: before 5.19.8, from 6.0.0 before 6.2.7.
Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache ActiveMQto a version that resolves this vulnerability.Fixed in 6.2.7 - Upgrade
Upgrade
Apache ActiveMQ Web Consoleto a version that resolves this vulnerability.Fixed in 6.2.7 - Upgrade
Upgrade
Apache ActiveMQto a version that resolves this vulnerability.Fixed in 5.19.8 - Upgrade
Upgrade
Apache ActiveMQ Web Consoleto a version that resolves this vulnerability.Fixed in 5.19.8
Event History
Frequently Asked Questions
What is the severity of CVE-2026-52760?
The severity of CVE-2026-52760 is rated as risk 30.
What is CVE-2026-52760?
CVE-2026-52760 is a Stored XSS vulnerability in Apache ActiveMQ and its Web Console due to improper sanitization of input.
How do I fix CVE-2026-52760?
To fix CVE-2026-52760, ensure that all user inputs are properly sanitized and update to the latest version of Apache ActiveMQ.
Who is affected by CVE-2026-52760?
Authenticated producers using the Apache ActiveMQ Web Console are affected by CVE-2026-52760.
What impact does CVE-2026-52760 have?
CVE-2026-52760 allows an authenticated user to execute malicious scripts in the context of the affected web console, potentially compromising user data.