CVE-2026-59271 Admin password disclosed in BrokerNotAliveException message
An attacker can obtain the admin password in cleartext from exception messages when the RabbitMQ aliveness check fails.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-59271?
CVE-2026-59271 is a medium-severity vulnerability in Spring AMQP, published on 27 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
When the RabbitMQ management aliveness check fails, the configured admin password is embedded in cleartext in the thrown exception message. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier
Weakness: CWE-209
Which versions are affected by CVE-2026-59271?
It affects 1 product.
Products include Vmware Spring Advanced Message Queuing Protocol.
How do I fix CVE-2026-59271?
Upgrade to a fixed version.
Is CVE-2026-59271 being exploited?
There is no known exploitation of CVE-2026-59271 in the wild and no public exploit code.
Other vulnerabilities in Spring AMQP
- CVE-2026-59272 Log4j2 AmqpAppender disables TLS hostname verification by default
- CVE-2026-59275 Deserialization in Spring AMQP
- CVE-2026-59320 In Spring AMQP the link credit never replenished on listener exception path
- CVE-2026-47860 Unbounded decompression of attacker-supplied compressed message bodies
- CVE-2021-22095 Deserialization of Untrusted Data in Spring AMQP
Sources
Also known as GHSA-372m-jx97-v923.