5.3
Medium
CVE-2026-59271 When the RabbitMQ management aliveness check fails, the configured admin password is embedded in cleartext in the thrown…
Description
When the RabbitMQ management aliveness check fails, the configured admin password is embedded in cleartext in the thrown exception message. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Spring AMQP | 4.1.0 | No fix stated |
| Spring AMQP 4.0 | 4.0.0 → 4.0.4 | No fix stated |
| Spring AMQP 3.2 | 3.2.0 → 3.2.12 | No fix stated |
| Spring AMQP 2.4 | earliest → 2.4.18 | No fix stated |
Other CVEs of Spring AMQP
The 8 CVEs of Spring AMQP →
CVE-2026-59320
When a container-level ErrorHandler is configured (the mitigation for finding 221000), each delivery whose processing…
6.5
Medium
CVE-2026-59272
Any application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, is…
6.8
Medium
CVE-2026-59275
A single hostile AMQP message can terminate the entire consumer JVM (System.exit(99)), not just the listener thread —…
6.6
Medium
CVE-2026-47860
An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the…
6.5
Medium