5.3Mittel
CVE-2026-59271Admin password disclosed in BrokerNotAliveException message
Beschreibung
When the RabbitMQ management aliveness check fails, the configured admin password is embedded in cleartext in the thrown exception message. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier
Schwachstellentyp (CWE):
CWE-209
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| Spring | Spring AMQP | 4.1.0, 4.0.0 – ≤ 4.0.4, 3.2.0 – ≤ 3.2.12, ≤ 2.4.18 | |
| vmware | spring advanced message queuing protocol | < 2.4.19 |
Referenzen und Patches
- https://spring.io/security/cve-2026-59271 Vendor Advisory
CPE-Treffer (NVD) (4)
cpe:2.3:a:vmware:spring_advanced_message_queuing_protocol:*:*:*:*:*:*:*:*< 2.4.19cpe:2.3:a:vmware:spring_advanced_message_queuing_protocol:*:*:*:*:*:*:*:*≥ 3.2.0 < 3.2.13cpe:2.3:a:vmware:spring_advanced_message_queuing_protocol:*:*:*:*:*:*:*:*≥ 4.0.0 < 4.0.4.1cpe:2.3:a:vmware:spring_advanced_message_queuing_protocol:*:*:*:*:*:*:*:*≥ 4.1.0 < 4.1.0.1