CVE-2026-59272

Analyzed Analyzed - Analysis Complete

Man-in-the-Middle Log Exposure in Spring AMQP

Publication date: 2026-08-27

Last updated on: 2026-09-01

Assigner: VMware

Description

Any application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, is exposed to man-in-the-middle interception of every log event. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-09-01

Generated

2026-09-17

AI Q&A

2026-08-27

EPSS Evaluated

2026-09-15

NVD

CVE-2026-59272

EUVD

EUVD-2026-67093

Affected Vendors & Products

Vendor	Product	Version / Range
vmware	spring_advanced_message_queuing_protocol	to 2.4.19 (exc)
vmware	spring_advanced_message_queuing_protocol	From 3.2.0 (inc) to 3.2.13 (exc)
vmware	spring_advanced_message_queuing_protocol	From 4.0.0 (inc) to 4.0.4.1 (exc)
vmware	spring_advanced_message_queuing_protocol	From 4.1.0 (inc) to 4.1.0.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-297	The product communicates with a host that provides a certificate, but the product does not properly ensure that the certificate is actually associated with that host.

Attack-Flow Graph

Executive Summary

This vulnerability affects Log4j2's AmqpAppender when sending logs to RabbitMQ over TLS. By default, the appender disables TLS hostname verification, allowing attackers to intercept, read, or alter log traffic containing sensitive data like tokens or PII without triggering certificate errors.

Detection Guidance

Check if your application uses Log4j2's AmqpAppender with RabbitMQ over TLS. Verify TLS hostname verification is disabled in the configuration. Inspect network traffic for unencrypted log transmission or unexpected certificate errors.

Impact Analysis

Attackers could intercept sensitive log data such as tokens, personally identifiable information (PII), or stack traces. This could lead to data breaches, unauthorized access, or information manipulation without detection.

Compliance Impact

This vulnerability could lead to unauthorized exposure of sensitive data, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations may face compliance penalties and reputational damage.

Mitigation Strategies

Upgrade to fixed versions: Spring AMQP 4.1.1 (OSS), 4.0.5 (OSS), 3.2.13 (Enterprise), or 2.4.19 (Enterprise). Ensure TLS hostname verification is explicitly enabled in Log4j2 AmqpAppender configuration.

Hi! I’m here to help you understand CVE-2026-59272. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70