CVE-2026-59272 Security Details

CVE ID

CVE-2026-59272

CWE

CWE-297

CVE Description

Any application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, is exposed to man-in-the-middle interception of every log event. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier

Published

Aug 20, 2026

CVSS Score & Severity

7.6High

CVSS Vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

EPSS Score

0.268%

Malware

malware

KEV Status

Not in KEV Catalog: No known exploits

Vulnerable Methods

org/springframework/amqp/rabbit/log4j2/AmqpAppender$Builder.build()Lorg/springframework/amqp/rabbit/log4j2/AmqpAppender;

JVM

Affected Ecosystems

affected

Source

National Vulnerability Database

References

spring.ioPROJECT