CVE-2026-59271: CWE-209 Generation of Error Message Containing Sensitive Information in Spring Spring AMQP

The vulnerability identified as CVE-2026-59271 in Spring AMQP involves the generation of error messages that contain sensitive information (the admin password) in cleartext when the RabbitMQ management aliveness check fails. This is categorized under CWE-209 (Generation of Error Message Containing Sensitive Information). Affected versions include 2.4.18 and earlier, 3.2.0 through 3.2.12, 4.0.0 through 4.0.4, and 4.1.0. The CVSS 3.1 base score is 5.3, indicating medium severity, with network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality impact but no integrity or availability impact. No vendor advisory or patch information is currently available.

The vulnerability can lead to exposure of the configured admin password in cleartext within exception messages when the RabbitMQ management aliveness check fails. This could allow an attacker with network access and low privileges to obtain sensitive credentials, potentially leading to unauthorized access or further compromise. However, the attack complexity is high and no integrity or availability impacts are reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid exposing exception messages containing sensitive information in logs or error outputs accessible to untrusted parties. Review application and infrastructure logging configurations to prevent leakage of sensitive data. Monitor vendor channels for updates or patches addressing this issue.