CVE-2026-59271: Admin password disclosed in BrokerNotAliveException message
When the RabbitMQ management aliveness check fails, the configured admin password is embedded in cleartext in the thrown exception message. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Operational
If the RabbitMQ admin password was exposed in logs via the BrokerNotAliveException message, rotate the RabbitMQ management/admin credentials after upgrading Spring AMQP.
Event History
Frequently Asked Questions
Which Spring AMQP versions are affected?
Affected versions are 4.1.0, 4.0.0 through 4.0.4, 3.2.0 through 3.2.12, and 2.4.18 and earlier.
What condition exposes the password?
The configured admin password is included in cleartext when the RabbitMQ management aliveness check fails and a BrokerNotAliveException is thrown.
What access would an attacker need to exploit this issue?
The listed vector requires network access and low privileges, with no user interaction. Exploitation also has high attack complexity.