Skip to content
OpenAdvisories
Medium · 5.3 CVE-2026-59271 EUVD-2026-66847GHSA-372m-jx97-v923

Admin password disclosed in BrokerNotAliveException message

Published Aug 27, 2026 · Updated Aug 27, 2026 · Assigned by vmware

Description

When the RabbitMQ management aliveness check fails, the configured admin password is embedded in cleartext in the thrown exception message.
Spring AMQP 4.1.0
Spring AMQP 4.0.0 - 4.0.4
Spring AMQP 3.2.0 - 3.2.12
Spring AMQP 2.4.18 and earlier

Affected products

VendorProductAffectedFixed
Spring Spring AMQP 4.1.0, 4.0.0 – ≤ 4.0.4, 3.2.0 – ≤ 3.2.12, ≤ 2.4.18 —

References