5.3Orta
CVE-2026-59271Admin password disclosed in BrokerNotAliveException message
Açıklama
When the RabbitMQ management aliveness check fails, the configured admin password is embedded in cleartext in the thrown exception message. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier
Zayıflık türü (CWE):
CWE-209
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| Spring | Spring AMQP | 4.1.0, 4.0.0 – ≤ 4.0.4, 3.2.0 – ≤ 3.2.12, ≤ 2.4.18 | |
| vmware | spring advanced message queuing protocol | < 2.4.19 |
Kaynaklar ve yamalar
- https://spring.io/security/cve-2026-59271 Vendor Advisory
CPE eşleşmeleri (NVD) (4)
cpe:2.3:a:vmware:spring_advanced_message_queuing_protocol:*:*:*:*:*:*:*:*< 2.4.19cpe:2.3:a:vmware:spring_advanced_message_queuing_protocol:*:*:*:*:*:*:*:*≥ 3.2.0 < 3.2.13cpe:2.3:a:vmware:spring_advanced_message_queuing_protocol:*:*:*:*:*:*:*:*≥ 4.0.0 < 4.0.4.1cpe:2.3:a:vmware:spring_advanced_message_queuing_protocol:*:*:*:*:*:*:*:*≥ 4.1.0 < 4.1.0.1