CVE-2026-59271
Received Received - Intake

Information Exposure in Spring AMQP

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: VMware

Description
When the RabbitMQ management aliveness check fails, the configured admin password is embedded in cleartext in the thrown exception message. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-27
Last Modified
2026-08-27
Generated
2026-08-27
AI Q&A
2026-08-27
EPSS Evaluated
N/A
NVD
CVE-2026-59271
EUVD
EUVD-2026-66847

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
spring amqp to 2.4.18 (inc)
spring amqp 4.1.0
spring amqp From 4.0.0 (inc) to 4.0.4 (inc)
spring amqp From 3.2.0 (inc) to 3.2.12 (inc)
spring amqp to 2.4.19 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-59271 is a medium-severity vulnerability in Spring AMQP where the configured admin password is exposed in cleartext when the RabbitMQ management aliveness check fails. The password appears in the BrokerNotAliveException message, potentially leaking credentials in logs or CI outputs.

Detection Guidance

Check CI logs or RabbitMQ management aliveness check outputs for BrokerNotAliveException messages containing cleartext admin passwords. Review logs for versions 4.1.0, 4.0.0-4.0.4, 3.2.0-3.2.12, or 2.4.18 and earlier.

Impact Analysis

This vulnerability can expose sensitive admin passwords in logs or CI outputs, allowing unauthorized access to RabbitMQ instances. Attackers with access to logs could use these credentials to gain control over RabbitMQ, leading to data breaches or service disruption.

Compliance Impact

This vulnerability may violate compliance requirements under GDPR and HIPAA due to unauthorized exposure of credentials. GDPR requires protection of personal data, while HIPAA mandates safeguarding sensitive health information. Unauthorized access risks data breaches, leading to potential legal and regulatory penalties.

Mitigation Strategies

Upgrade to fixed versions: 4.1.1 OSS, 4.0.5 OSS, 3.2.13, or 2.4.19. No additional mitigation steps are required beyond upgrading.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-59271. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart