CVE-2026-59271: Admin password disclosed in BrokerNotAliveException message

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-27 · updated 2026-09-01
Weakness: CWE-209

Description

When the RabbitMQ management aliveness check fails, the configured admin password is embedded in cleartext in the thrown exception message. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier

Affected products

Spring AMQP: before 2.4.19; from 3.2.0 before 3.2.13; from 4.0.0 before 4.0.4.1; from 4.1.0 before 4.1.0.1 — fixed in 2.4.19, 3.2.13, 4.0.4.1, 4.1.0.1
Spring AMQP: from 4.0.0 through 4.0.4; from 3.2.0 through 3.2.12; through 2.4.18; 4.1.0

How to fix

Upgrade to a fixed version: Spring AMQP 2.4.19, 3.2.13, 4.0.4.1, 4.1.0.1. Check the vendor advisory for mitigations.

References

https://spring.io/security/cve-2026-59271

Get alerted when CVE-2026-59271 or the next vulnerability affects your stack