Skip to main content
protocols.pageprotocols.page
8161

Port 8161 – Apache ActiveMQ Web Console

TCP

Port 8161 is the Apache ActiveMQ web console port. ActiveMQ Classic uses 8161 for its admin UI and REST API. The default credentials are admin/admin. In 2023, a critical remote code execution vulnerability (CVE-2023-46604) in ActiveMQ's OpenWire protocol (port 61616) made unpatched instances trivial to compromise. Port 8161 should require strong authentication and not be publicly exposed.

Port Number

8161

Protocol

TCP

Service

ActiveMQ Management Console

Range

IANA Registered (1024–49151)

Description

ActiveMQ's web console on port 8161 provides queue management, message browsing, and broker statistics. The OpenWire broker protocol uses port 61616. CVE-2023-46604 (CVSS 10.0) allowed unauthenticated remote code execution via port 61616. Port 8161 should be firewalled, have its default credentials changed, and ideally sit behind a reverse proxy with TLS.

Security risks

  • 1CVE-2023-46604 (CVSS 10.0): Apache ActiveMQ RCE via ClassInfo manipulation – unauthenticated attacker on the OpenWire port (61616) executes arbitrary commands as the ActiveMQ user. Actively exploited in the wild for ransomware deployment (HelloKitty, TellYouThePass)
  • 2CVE-2016-3088: ActiveMQ web console file upload via REST API – allows writing arbitrary files to the server including JSP webshells (requires admin/admin default creds)
  • 3Default credentials: admin/admin on the web console (port 8161) – over 50% of internet-exposed ActiveMQ instances still use defaults (per Shodan scans)
  • 4Web console exposes full broker management: queue/topic creation, message browsing (view message content including credentials), connection management, and JMX operations
  • 5Jolokia JMX endpoint exposed via web console (/api/jolokia/) allows reading MBeans, triggering GC, and in some configurations executing arbitrary code via MBean operations

Firewall guidance

Port 8161 should NEVER be internet-accessible. Restrict to admin workstations only. Change admin/admin immediately (conf/jetty-realm.properties). For CVE-2023-46604: patch to 5.15.16+/5.16.7+/5.17.6+/5.18.3+ OR block OpenWire port 61616 from untrusted networks. In AWS, use Amazon MQ which handles patching and restricts console access to VPC.

Diagnosis commands

Check if default credentials still work (should return 401 after hardening)

shell
curl -u admin:admin http://localhost:8161/admin/ -o /dev/null -w '%{http_code}'

Get ActiveMQ version via Jolokia (check if CVE-2023-46604 patch needed)

shell
curl -s http://localhost:8161/api/jolokia/read/org.apache.activemq:type=Broker,brokerName=localhost | jq .value.BrokerVersion

Scan for default credentials and service versions

shell
nmap -sV -p 8161,61616 --script=http-default-accounts target

Check configured web console users (look for default 'admin' entries)

shell
grep -r 'admin' /opt/activemq/conf/jetty-realm.properties

Usage examples

Port 8161 – Apache ActiveMQ Web Console
shell
curl -u admin:admin http://localhost:8161/api/brokers
curl -u admin:admin http://localhost:8161/api/queues

Common services on this port

Apache ActiveMQ ClassicApache ActiveMQ Artemis (on 8161 or 8443)Amazon MQ (managed ActiveMQ)

Related ports

61616

ActiveMQ OpenWire (main broker port)

5672

AMQP (ActiveMQ supports)

1883

MQTT (ActiveMQ supports)

61613

STOMP (ActiveMQ supports)

8161

ActiveMQ web console (this port)

History

ActiveMQ was created at LogicBlaze in 2004, donated to Apache Foundation in 2005. Port 8161 was chosen for the embedded Jetty web console. ActiveMQ became the most popular open-source message broker before Kafka (2011) and RabbitMQ's rise. ActiveMQ Artemis (the next-generation broker, merged from HornetQ) uses the same port. CVE-2023-46604 in October 2023 was one of the most exploited vulnerabilities of the year.

FAQ

How do I patch CVE-2023-46604?

Upgrade to ActiveMQ 5.15.16, 5.16.7, 5.17.6, or 5.18.3+. If immediate upgrade impossible: set environment variable ACTIVEMQ_OPTS=-Dorg.apache.activemq.SERIALIZABLE_PACKAGES=java.lang,javax.security,java.util,org.apache.activemq,org.fusesource.hawtbuf,com.thoughtworks.xstream.converters.collections to restrict deserialization classes. Also block external access to port 61616.

ActiveMQ Classic vs Artemis?

ActiveMQ Classic: mature, widely deployed, KahaDB storage, simpler configuration. Artemis: high-performance (journal-based storage, non-blocking architecture), supports AMQP 1.0 natively, better clustering (live/backup pairs). New deployments should use Artemis. Classic is in maintenance mode. Both use port 8161 for web console by default.