CVE-2026-41714: In Spring AMQP the RabbitConnectionFactoryBean.setUri("amqps://...") bypasses secure SSL setup, uses TrustEverythingTrustManager
Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri("amqps://...") without also calling setUseSSL(true) get TLS encryption with no certificate validation and no hostname verification.
Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.
Affected Software
Event History
Frequently Asked Questions
What is the risk associated with CVE-2026-41714?
The risk associated with CVE-2026-41714 is rated medium with a risk score of 22.
How does CVE-2026-41714 affect SSL setup in Spring AMQP?
CVE-2026-41714 allows RabbitConnectionFactoryBean.setUri("amqps://...") to bypass secure SSL setup, leading to potential TLS encryption without certificate validation.
What versions of Spring AMQP are affected by CVE-2026-41714?
Affected versions by CVE-2026-41714 include Spring AMQP 4.0.0 through 4.0.3, 3.2.0 through 3.2.10, and earlier versions.
How can I mitigate the vulnerability identified in CVE-2026-41714?
To mitigate CVE-2026-41714, ensure to call setUseSSL(true) when configuring the RabbitConnectionFactoryBean.
What is the consequence of using TrustEverythingTrustManager in CVE-2026-41714?
The use of TrustEverythingTrustManager in CVE-2026-41714 results in TLS encryption without any certificate validation or hostname verification.