Executive brief
Spring AMQP is a messaging library used by Java applications to communicate with RabbitMQ brokers. When the RabbitMQ management aliveness check fails, the configured admin password is exposed in cleartext within the exception error message, allowing anyone with access to logs or error output to retrieve database credentials. This credential exposure could lead to unauthorized access to the message broker and sensitive business data.
Technical details
The vulnerability is an information disclosure flaw in Spring AMQP's RabbitMQ management connectivity check. When the aliveness check fails, the underlying exception message contains the plaintext admin password instead of being redacted or obfuscated. The vulnerability affects Spring AMQP 4.1.0, 4.0.0–4.0.4, 3.2.0–3.2.12, and 2.4.18 and earlier versions. No special authentication or network access preconditions are required beyond normal application operation; any application logs or error monitoring systems that capture exception messages will expose the credentials. A fix is available in patched versions of Spring AMQP.
Affected products
- VMware Spring AMQP 4.1.0, 4.0.0–4.0.4, 3.2.0–3.2.12, 2.4.18 and earlier
Timeline
- 2026-08-27: disclosed
- 2026-08-27: advisory