Description

Any application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, is exposed to man-in-the-middle interception of every log event. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-08-27T17:18:57.423Z",
  "pubdate": "2026-08-27T17:18:57.423Z",
  "executiveSummary": "A critical vulnerability exists in Spring AMQP that exposes log data to man-in-the-middle (MitM) interception when using the Log4j2 appender configured with TLS over RabbitMQ.\nThe vulnerability stems from insecure default TLS configuration settings within the Spring AMQP framework, which fail to adequately validate or enforce certificate verification.\nAffected products include Spring AMQP versions 4.1.0, 4.0.0 - 4.0.4, 3.2.0 - 3.2.12, and 2.4.18 and earlier.\nThe impact allows an attacker with a position on the network path to intercept, inspect, and potentially manipulate sensitive log events transmitted between the application and the RabbitMQ broker.\nThis represents a significant risk to data confidentiality and integrity, as logs frequently contain sensitive diagnostic information, user data, or security-sensitive metadata.\nExploitation does not require prior authentication to the application, only the ability to intercept network traffic between the application node and the RabbitMQ server. Systems relying on default configuration settings are inherently exposed to this interception vector.",
  "technicalDetails": "The root cause of this vulnerability lies in the default TLS handshake implementation within the Spring AMQP Log4j2 appender. When configured for TLS-encrypted communication with a RabbitMQ broker, the client-side implementation fails to strictly validate the server's identity, effectively ignoring critical TLS certificate chain validation requirements.\nBy relying on documented default configurations, the application establishes a connection that is susceptible to interception. An attacker positioned as a man-in-the-middle can present a self-signed or otherwise untrusted certificate to the application client. Because the Spring AMQP component does not enforce rigorous hostname verification or validate the trust anchor of the certificate presented during the handshake, the connection is accepted as legitimate.\nThe attack flow proceeds as follows: 1) The attacker intercepts the TCP handshake between the Log4j2 appender and the RabbitMQ broker. 2) The attacker initiates an intercepting proxy or transparent bridge that presents a fraudulent certificate to the application client. 3) The application, due to the lack of strict TLS verification defaults, establishes a secure tunnel to the attacker's proxy rather than the legitimate broker. 4) All subsequent log events generated by Log4j2 are transmitted through the attacker-controlled proxy, where they are decrypted, logged, or potentially modified before being forwarded to the actual RabbitMQ server to avoid service disruption.\nThe vulnerable component resides in the Spring AMQP client-side infrastructure responsible for managing AMQP connections via the Log4j2 appender. This is not a vulnerability in the RabbitMQ broker itself, but rather in how the Spring AMQP library initializes and configures its SSLContext for outbound log transmission.\nThe lack of authentication requirements for the interception vector makes this a network-layer threat. Any attacker capable of routing traffic between the application and the broker can perform this attack, regardless of their privileges within the application environment. The post-exploitation impact includes the total loss of confidentiality for all log data traversing the network, which may include PII, session tokens, or internal system configurations leaked via verbose logging.\nThis vulnerability persists across major versions of Spring AMQP, indicating that the default security posture regarding TLS verification remained unchanged across these releases, necessitating manual configuration to achieve a secure state."
}