Vulnerability · Published Apr 24, 2026 · Assigned by apache
CVE-2026-41043Apache ActiveMQ, Apache ActiveMQ Web: ActiveMQ Web Console - XSS vulnerability when browsing queues
Medium 6.5
In plain English
A medium-severity cross-site scripting in Apache ActiveMQ from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache ActiveMQ, Apache ActiveMQ Web. An authenticated attacker can show malicious content when browsing queues in the web console by overriding the content type to be HTML (instead of XML) and by injecting HTML into a JMS selector field. This issue affects Apache ActiveMQ: before 5.19.6, from 6.0.0 before 6.2.5; Apache ActiveMQ Web: before 5.19.6, from 6.0.0 before 6.2.5. Users are recommended to upgrade to version 6.2.5 or 5.19.6, which fixes the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | activemq | no fix listed | DEBIAN-CVE-2026-41043 |
| Debian:13 | activemq | no fix listed | DEBIAN-CVE-2026-41043 |
| Maven | org.apache.activemq:activemq-all | 5.19.6 | GHSA-2jp3-2923-9h52 |
| Maven | org.apache.activemq:activemq-all | 6.2.5 | GHSA-2jp3-2923-9h52 |
| Maven | org.apache.activemq:activemq-broker | 5.19.6 | GHSA-2jp3-2923-9h52 |
| Maven | org.apache.activemq:activemq-broker | 6.2.5 | GHSA-2jp3-2923-9h52 |
| Maven | org.apache.activemq:apache-activemq | 5.19.6 | GHSA-2jp3-2923-9h52 |
| Maven | org.apache.activemq:apache-activemq | 6.2.5 | GHSA-2jp3-2923-9h52 |
| Ubuntu:24.04:LTS | activemq | no fix listed | UBUNTU-CVE-2026-41043 |
| Ubuntu:25.10 | activemq | no fix listed | UBUNTU-CVE-2026-41043 |
| Ubuntu:26.04:LTS | activemq | no fix listed | UBUNTU-CVE-2026-41043 |
| Ubuntu:26.10 | activemq | no fix listed | UBUNTU-CVE-2026-41043 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache ActiveMQ | 0 – before 5.19.66.0.0 – before 6.2.5 |
| Apache Software Foundation | Apache ActiveMQ Web | 0 – before 5.19.66.0.0 – before 6.2.5 |
Weakness: CWE-79, CWE-915 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N