Description

When the RabbitMQ management aliveness check fails, the configured admin password is embedded in cleartext in the thrown exception message. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-27T06:17:21.510Z",
  "pubdate": "2026-08-27T06:17:21.510Z",
  "executiveSummary": "A critical information disclosure vulnerability exists in Spring AMQP that leads to the leakage of administrative credentials via exception handling.\nThe vulnerability occurs when the RabbitMQ management aliveness check fails, causing the application to throw an exception that embeds the configured admin password in cleartext within the error message string.\nThis flaw impacts multiple versions of Spring AMQP, including 4.1.0, 4.0.0-4.0.4, 3.2.0-3.2.12, and 2.4.18 and earlier.\nThe risk implication is significant, as an attacker or an unauthorized user with access to application logs or error reporting interfaces can harvest valid administrative credentials.\nSuccessful exploitation requires the aliveness check to fail, which may occur during connectivity issues or misconfiguration, subsequently exposing highly sensitive authentication data.\nThis vulnerability compromises the confidentiality of administrative credentials, potentially allowing unauthorized actors to gain full control over the RabbitMQ management interface, leading to wider system exploitation.",
  "technicalDetails": "The vulnerability resides in the error-handling logic within the Spring AMQP components responsible for performing RabbitMQ management aliveness checks. When these checks fail, the system generates an exception object to describe the failure condition.\nThe root cause is the improper sanitization of exception messages during the reporting process. Instead of masking sensitive configuration parameters, the implementation serializes the configuration object directly into the exception's string representation. This includes the administrative username and password credentials used to establish the management connection.\nThe attack flow begins with a trigger that forces an aliveness check failure. This can be induced by intentional network disruption between the application and the RabbitMQ management port, or by causing an intermittent authentication or authorization state change. Once the exception is thrown, the sensitive credential data is written into the application's runtime logs, console output, or potentially returned to an API caller if the error message is propagated to the client.\nAffected versions include Spring AMQP 4.1.0, 4.0.0 through 4.0.4, 3.2.0 through 3.2.12, and 2.4.18 and earlier. Because these versions are widely used in enterprise Java environments, the attack surface is broad.\nExploitation does not require prior knowledge of the credentials. An attacker with access to log aggregation tools (e.g., ELK stack, Splunk) or monitoring dashboards where these stack traces are indexed can perform a simple keyword search to extract plaintext credentials. If the application environment is configured to display verbose error pages to end users, the credentials may even be exposed directly via the web browser or API response.\nPost-exploitation impact is severe, as the exposed credentials typically grant full administrative rights over the RabbitMQ broker. An attacker can leverage this access to manage queues, purge messages, modify exchange configurations, or manipulate access control lists, effectively facilitating persistent unauthorized control over the message broker infrastructure."
}