CVE-2026-59271

Analyzed Analyzed - Analysis Complete

Information Exposure in Spring AMQP

Publication date: 2026-08-27

Last updated on: 2026-09-01

Assigner: VMware

Description

When the RabbitMQ management aliveness check fails, the configured admin password is embedded in cleartext in the thrown exception message. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-09-01

Generated

2026-09-16

AI Q&A

2026-08-27

EPSS Evaluated

2026-09-15

NVD

CVE-2026-59271

EUVD

EUVD-2026-66847

Affected Vendors & Products

Vendor	Product	Version / Range
vmware	spring_advanced_message_queuing_protocol	to 2.4.19 (exc)
vmware	spring_advanced_message_queuing_protocol	From 3.2.0 (inc) to 3.2.13 (exc)
vmware	spring_advanced_message_queuing_protocol	From 4.0.0 (inc) to 4.0.4.1 (exc)
vmware	spring_advanced_message_queuing_protocol	From 4.1.0 (inc) to 4.1.0.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-209	The product generates an error message that includes sensitive information about its environment, users, or associated data.

Attack-Flow Graph

Executive Summary

CVE-2026-59271 is a medium-severity vulnerability in Spring AMQP where the configured admin password is exposed in cleartext when the RabbitMQ management aliveness check fails. The password appears in the BrokerNotAliveException message, potentially leaking credentials in logs or CI outputs.

Detection Guidance

Check CI logs or RabbitMQ management aliveness check outputs for BrokerNotAliveException messages containing cleartext admin passwords. Review logs for versions 4.1.0, 4.0.0-4.0.4, 3.2.0-3.2.12, or 2.4.18 and earlier.

Impact Analysis

This vulnerability can expose sensitive admin passwords in logs or CI outputs, allowing unauthorized access to RabbitMQ instances. Attackers with access to logs could use these credentials to gain control over RabbitMQ, leading to data breaches or service disruption.

Compliance Impact

This vulnerability may violate compliance requirements under GDPR and HIPAA due to unauthorized exposure of credentials. GDPR requires protection of personal data, while HIPAA mandates safeguarding sensitive health information. Unauthorized access risks data breaches, leading to potential legal and regulatory penalties.

Mitigation Strategies

Upgrade to fixed versions: 4.1.1 OSS, 4.0.5 OSS, 3.2.13, or 2.4.19. No additional mitigation steps are required beyond upgrading.

Hi! I’m here to help you understand CVE-2026-59271. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70