The vulnerability CVE-2026-41701 in Spring AMQP arises from the use of predictable correlation IDs in the RabbitTemplate.sendAndReceive() method when using a fixed reply queue. The correlation IDs are generated using a simple internal counter, making them insufficiently random (CWE-330). This predictability can allow an attacker with high privileges and network access to potentially infer or manipulate message correlation, affecting confidentiality and integrity of message exchanges. The affected versions include Spring AMQP 2.4.0 through 2.4.17, 3.1.0 through 3.1.15, 3.2.0 through 3.2.10, and 4.0.0 through 4.0.3. The CVSS v3.1 base score is 4.4 (medium severity), with attack vector network, high attack complexity, high privileges required, no user interaction, and scope changed. No vendor advisory or patch information is currently available.

The vulnerability allows correlation IDs to be predictable, which can lead to potential confidentiality and integrity issues in message correlation within Spring AMQP applications using RabbitTemplate.sendAndReceive() with fixed reply queues. This could enable attackers with sufficient privileges and network access to infer or manipulate message flows. There is no indication of availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider avoiding the use of fixed reply queues with RabbitTemplate.sendAndReceive() or implement additional application-level controls to mitigate risks associated with predictable correlation IDs.