CVE-2026-59302

Overview

Spring Cloud Stream is a framework for building message-driven microservices on top of Spring Boot and Spring Integration. It provides a binder abstraction that connects application code to messaging middleware such as RabbitMQ, Apache Kafka and Apache Pulsar, so the same business logic can run against different brokers without being rewritten.

An information exposure vulnerability (CVE-2026-59302) has been identified in the Spring Cloud Stream RabbitMQ binder, which allows attackers who can name a queue or an exchange to have that raw name carried into RabbitMQ management API request paths and into the log and error output that records the operation.

Per OWASP: Access control enforces policy such that users cannot act outside of their intended permissions. Failures typically lead to unauthorized information disclosure, modification, or destruction of all data or performing a business function outside the user's limits.

This issue affects multiple versions of Spring Cloud Stream, beginning with the release that replaced the RabbitMQ HTTP client library with hand-assembled management API calls.

Details

Module Info

• Product: Spring Cloud Stream
• Affected packages: org.springframework.cloud:spring-cloud-stream-binder-rabbit-core
• Affected versions: >=4.0.0 <=4.0.5, >=4.1.0 <=4.1.6, >=4.2.0 <=4.2.3, >=4.3.0 <=4.3.3, >=5.0.0 <5.0.3
• GitHub repository: https://github.com/spring-cloud/spring-cloud-stream
• Published packages: https://central.sonatype.com/artifact/org.springframework.cloud/spring-cloud-stream-binder-rabbit-core
• Package manager: Maven
• Fixed in: NES for Spring Cloud Stream v4.1.9, v4.2.6 and v4.3.5

Vulnerability Info

This Low-severity vulnerability is found in the spring-cloud-stream-binder-rabbit-core package in multiple versions of Spring Cloud Stream. RabbitBindingCleaner removes queues and exchanges by calling the RabbitMQ management API over HTTP, and it assembles each request path by string concatenation. The virtual host segment is passed through UriUtils.encodePathSegment, but the queue name and the exchange name are appended without any encoding:

private void deleteQueue(WebClient client, URI uri, String vhost, String q) {
    URI deleteURI = uri
            .resolve("/api/queues/" + UriUtils.encodePathSegment(vhost, StandardCharsets.UTF_8) + "/" + q);
    client.delete()
            .uri(deleteURI)
            .retrieve()
            .toEntity(Void.class)
            .block(Duration.ofSeconds(10));
}

deleteExchange builds its /api/exchanges/ path the same way. Because the trailing segment is not encoded, reserved and non-ASCII characters in a queue or exchange name are placed verbatim into the resolved URI rather than being escaped, and that URI is what the binder reports when it logs the cleanup operation or when the management call fails. A name chosen to carry sensitive or structured content is therefore reproduced in application logs and in the request line sent to the broker, where the reader of those logs is not the party who supplied the name.

Exploitation is constrained: the attacker needs the privileges required to create or influence a binding name, the cleanup path has to be invoked, and the payoff is limited to the confidentiality and integrity of the logged data rather than control of the application. This is reflected in the vendor score of CVSS 3.1 3.1 (AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N).

This vulnerability was introduced in 2022 with Spring Cloud Stream 4.0.0.

Mitigation

Only recent versions of Spring Cloud Stream receive community support. Older lines are End-of-Life and will not receive public updates to address this issue.

Users of the affected components should apply one of the following mitigations:

• Upgrade to a currently supported version of Spring Cloud Stream.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• No finder has been publicly credited for this issue.