Spring AMQP Information Exposure — CVE-2026-59271

Overview

Spring AMQP applies core Spring concepts to the development of AMQP-based messaging solutions, providing a template abstraction for publishing and receiving messages, listener containers for asynchronous consumption, and support classes for declaring RabbitMQ exchanges, queues, and bindings.

An Information Exposure vulnerability (CVE-2026-59271) has been identified in the BrokerRunningSupport test utility of Spring AMQP, which allows anyone with read access to build output or CI logs to recover the configured RabbitMQ administrator password in cleartext.

Per OWASP: Sensitive data exposure occurs when an application does not adequately protect sensitive information, including credentials, from disclosure. Logging and monitoring output is a common exposure path, since log data is frequently retained and readable by a broader audience than the system it describes.

This issue affects the JUnit test support of Spring AMQP.

‍

Details

Module Info

• Product: Spring AMQP
• Affected packages: org.springframework.amqp:spring-rabbit-junit
• Affected versions: >= 3.0.0 < 3.2.13, >= 4.0.0 < 4.0.5, >= 4.1.0 < 4.1.1
• GitHub repository: https://github.com/spring-projects/spring-amqp
• Published packages: https://central.sonatype.com/artifact/org.springframework.amqp/spring-rabbit-junit
• Package manager: Maven
• Fixed in
  
  • NES for Spring AMQP lines 3.1.x and 3.2.x
  • OSS Spring AMQP 4.0.5 and 4.1.1

Vulnerability Info

This Medium-severity vulnerability is found in the org.springframework.amqp:spring-rabbit-junit package in the JUnit test support of Spring AMQP.

The aliveness probe against the RabbitMQ management plugin interpolated the administrator credentials, including the password, into the exception it throws when the probe fails:

if (body == null || !body.contentEquals("{\"status\":\"ok\"}")) {
    throw new BrokerNotAliveException("Aliveness test failed for " + uri
            + " user: " + getAdminUser() + " pw: " + getAdminPassword()
            + " status: " + response.statusCode() + " body: " + body
            + "; management not available");
}

The password reaches the message in cleartext, and the exception is surfaced through normal test reporting. When a pipeline supplies a real credential through the admin password environment variable and requires the broker to be up, the failure path prints that credential into test output and CI logs, where it is retained and readable by anyone with log access.

This vulnerability was introduced in 2022 with Spring AMQP 3.0.0.

‍

Mitigation

Only recent versions of Spring AMQP receive community support. Older lines are End-of-Life and will not receive public updates to address this issue.

Users of the affected components should apply one of the following mitigations:

• Upgrade to a currently supported version of Spring AMQP.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.