CVE-2026-59271CWE-209

CVE-2026-59271

Medium · published August 27, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
24.2
In the wild
Unconfirmed
What it is

When the RabbitMQ management aliveness check fails, the configured admin password is embedded in cleartext in the thrown exception message.

Spring AMQP 4.1.0

Spring AMQP 4.0.0 - 4.0.4

Spring AMQP 3.2.0 - 3.2.12

Spring AMQP 2.4.18 and earlier

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00324 · 24.2th percentile
Weakness
CWE-209 · Generation of Error Message Containing Sensitive Information
Published
2026-08-27T10:17Z
Affected products (4)
ProductVersionsFixed in
vmware/spring_advanced_message_queuing_protocol< 2.4.192.4.19
vmware/spring_advanced_message_queuing_protocol≥ 3.2.0, < 3.2.133.2.13
vmware/spring_advanced_message_queuing_protocol≥ 4.0.0, < 4.0.4.14.0.4.1
vmware/spring_advanced_message_queuing_protocol≥ 4.1.0, < 4.1.0.14.1.0.1
References (1)
https://spring.io/security/cve-2026-59271 · [email protected]
EPSS history
Timeline
  • 28 AUG 06:47Z
    EPSS moved — → 0%
    epss
  • 27 AUG 05:20Z
    Admin password disclosed in BrokerNotAliveException message
    cvelistv5