Apache ActiveMQ: Jolokia and REST API were not secured with default configuration
Description
In Apache ActiveMQ 6.x, the default configuration doesn't secure the API web context (where the Jolokia JMX REST API and the Message REST API are located). It means that anyone can use these layers without any required authentication. Potentially, anyone can interact with the broker (using Jolokia JMX REST API) and/or produce/consume messages or purge/delete destinations (using the Message REST API).
To mitigate, users can update the default conf/jetty.xml configuration file to add authentication requirement:
Or we encourage users to upgrade to Apache ActiveMQ 6.1.2 where the default configuration has been updated with authentication by default.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.apache.activemq:apache-activemqMaven | >= 6.0.0, < 6.1.2 | 6.1.2 |
Affected products
3- osv-coords2 versions
>= 6.0.0, < 6.1.2+ 1 more
- (no CPE)range: >= 6.0.0, < 6.1.2
- (no CPE)range: >= 6.0.0, < 6.1.2
Patches
Vulnerability mechanics
References
6- activemq.apache.org/security-advisories.data/CVE-2024-32114-announcement.txtghsavendor-advisoryWEB
- github.com/advisories/GHSA-gj5m-m88j-v7c3ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2024-32114ghsaADVISORY
- github.com/apache/activemq/commit/43cc596219b6a8c8b5a54fbda3fb68cb4424f2d0ghsaWEB
- github.com/apache/activemq/pull/1201ghsaWEB
- issues.apache.org/jira/browse/AMQ-9477ghsaWEB
News mentions
2- ThreatsDay Bulletin: $290M DeFi Hack, macOS LotL Abuse, ProxySmart SIM Farms +25 New StoriesThe Hacker News · Apr 23, 2026
- Claude Discovers Apache ActiveMQ Bug Hidden for 13 YearsInfosecurity Magazine · Apr 8, 2026