CVE-2026-59272
Received
Received - Intake
Man-in-the-Middle Log Exposure in Spring AMQP
Vulnerability report for CVE-2026-59272, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-08-27
Last updated on: 2026-08-27
Assigner: VMware
Description
Description
Any application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, is exposed to man-in-the-middle interception of every log event.
Spring AMQP 4.1.0
Spring AMQP 4.0.0 - 4.0.4
Spring AMQP 3.2.0 - 3.2.12
Spring AMQP 2.4.18 and earlier
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| spring | amqp | 4.1.0 |
| spring | amqp | From 4.0.0 (inc) to 4.0.4 (inc) |
| spring | amqp | From 3.2.0 (inc) to 3.2.12 (inc) |
| spring | amqp | to 2.4.19 (exc) |
| spring | amqp | to 4.0.4 (inc) |
| spring | amqp | to 3.2.12 (inc) |
| spring | amqp | 2.4.18 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
