Spring AMQP CVE-2026-59271

The Spring AMQP application must be explicitly configured to use the RabbitMQ management aliveness check - this is not enabled by default and requires the developer to configure the RabbitMQ management HTTP endpoint URL and admin credentials within the application. The aliveness check must fail at runtime to trigger the vulnerable exception path; failure can occur due to RabbitMQ being unreachable, the management plugin being disabled on the broker, or a misconfigured endpoint. The attacker must additionally have low-privilege access (PR:L per CVSS) to a system that captures exception output - such as a log aggregation service, APM agent, error tracker, or centralized logging platform. Exploitation is limited by: the failure condition must actually occur (not reliably attacker-controlled without access to the broker or network layer), access to exception/log output is required and not universally available, and the vulnerability does not enable direct remote code execution or integrity compromise.

The CVSS 3.1 score of 5.3 Medium with vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N reflects a narrowly scoped but meaningful confidentiality-only risk. AC:H acknowledges that the vulnerable code path requires the aliveness check to fail - a condition that may not be constantly present or attacker-controlled. PR:L indicates that low-privilege access to a log or monitoring system is required to observe the exception message; this is not a zero-touch remote exploit. C:H is justified because the exposed credential is an admin password, which if captured grants full control over the RabbitMQ management API. No EPSS score was provided; exploitation probability cannot be quantified from available data. KEV status is unconfirmed. No public exploit code has been identified. The practical risk is highest in environments with broadly shared log aggregation platforms, centralized monitoring dashboards with weak access controls, or developer-accessible error tracking services - scenarios common in enterprise Spring Boot deployments. The vulnerability is not automatable at scale and is not a direct remote code execution path, making it lower priority than network-exploitable RCE at similar CVSS scores, but it presents a real lateral-movement risk if the admin password enables broader infrastructure access.

An attacker with read access to a shared log aggregation platform (such as a developer-accessible Elasticsearch/Kibana stack or an APM tool) searches for Spring AMQP exception messages recorded during a period when RabbitMQ was temporarily unavailable - a common occurrence during maintenance windows or infrastructure events. The exception message contains the admin password in cleartext, which the attacker extracts and uses to log into the RabbitMQ management UI with full administrative privileges. No public exploit code has been identified at time of analysis; exploitation relies on opportunistic log access rather than any specialized tooling.