Port reference
Port 8161 (TCP) – Apache ActiveMQ web console
Default port for the Apache ActiveMQ web console (Jetty), the HTTP admin and Jolokia management interface for the broker.
Quick facts
- Transport
- tcp
- Category
- Registered
- Risk level
- Critical
Actively exploited and high-impact — keep it off the public internet.
Default state
ActiveMQ ships the web console with default admin/admin credentials. If 8161 is exposed, attackers gain broker administration and management API access.
What is port 8161 used for?
Port 8161 is the default for the Apache ActiveMQ web console, a Jetty-hosted admin interface for the message broker. Operators use it to manage queues and topics, watch connections, and send test messages, and it also exposes a Jolokia management API. The broker's actual messaging protocol, OpenWire, runs separately on port 61616.
When would you open it?
Open or forward 8161 only if you administer an ActiveMQ broker and want to reach its web console from another machine. Most teams keep it on an internal network, since it is a management interface rather than something applications connect to.
Is it safe to open?
ActiveMQ ships the console with default admin/admin credentials and it grants full broker control, so change the password and keep it off the public internet. See the security notes below.
How to check if this port is open
ss -tulpn | grep :8161
nmap -p 8161 <target>netstat -ano | findstr :8161
Test-NetConnection <host> -Port 8161lsof -i :8161
nmap -p 8161 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 8161 to your device's local IP, internal port 8161, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 8161/tcpsudo firewall-cmd --permanent --add-port=8161/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 8161 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 8161" -Direction Inbound -Protocol TCP -LocalPort 8161 -Action AllowSecurity & risks
Common attacks
- Login with default admin/admin web console credentials
- Broker administration and queue manipulation via the console
- Abuse of the Jolokia/management API for configuration changes
- Pivot to the OpenWire broker on 61616 (e.g. CVE-2023-46604 RCE)
Hardening
- Change the default admin/admin credentials immediately
- Bind the console to localhost or a private interface; firewall 8161
- Restrict or disable the Jolokia management API where unused
- Put the console behind a reverse proxy with authentication and TLS
- Patch ActiveMQ promptly (notably for CVE-2023-46604)
How to block this port
sudo ufw deny 8161/tcpsudo firewall-cmd --permanent --remove-port=8161/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 8161 -j DROPNew-NetFirewallRule -DisplayName "Block 8161" -Direction Inbound -Protocol TCP -LocalPort 8161 -Action Blocknmap snippet
nmap -p8161 --script http-title <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- What are the default ActiveMQ web console credentials?
- Apache ActiveMQ ships the web console with admin/admin. If 8161 is exposed and the password is unchanged, an attacker gets full broker administration. Change credentials and firewall the port.
- Is the ActiveMQ console related to CVE-2023-46604?
- CVE-2023-46604 is an unauthenticated RCE in the OpenWire protocol on 61616, not the console itself. But an exposed 8161 signals an ActiveMQ host that is likely also exposing the vulnerable 61616.