PT-2026-89624

Name of the Vulnerable Software and Affected Versions IBM DataStage on Cloud Pak for Data version 5.4.0.0 Description Improper authorization allows a remote authenticated attacker to cause a denial of service by deleting arbitrary RabbitMQ queues or exchanges. RabbitMQ is a message broker that...

Ubuntu 14.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS / Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS : rabbitmq-c vulnerabilities (USN-8724-1)

The remote Ubuntu 14.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS / Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8724-1 advisory. It was discovered that the rabbitmq-c...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: rabbitmq-server4.3: rabbitmq-server4.3-4.3.5-1.1.hum1 aarch64, x8664 rabbitmq-server4.3-4.3.5-1.1.hum1.src src Security Fixes: rabbitmq-server4.3: CVE-2026-43971...

USN-8724-1: rabbitmq-c vulnerabilities

It was discovered that the rabbitmq-c command-line tools only accepted credentials on the command line, making them visible to other local users through the process list. An attacker could possibly use this to obtain sensitive credentials. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04...

Linux Distros Unpatched Vulnerability : CVE-2026-59272

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Any application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, is exposed to man-in-the-middle interception of...

Cleartext Storage Of Sensitive Information

Spring AMQP is vulnerable to Cleartext Storage of Sensitive Information. The vulnerability is due to the configured admin password being embedded in cleartext in the exception message when the RabbitMQ management aliveness check fails...

CLEANSTART-2026-CW06250 Security fixes in rabbitmq-cluster-operator 2.22.4-r0

Package rabbitmq-cluster-operator version 2.22.4-r0 fixes 8 vulnerabilities: CVE-2026-39821, CVE-2026-56860, CVE-2026-56858, CVE-2026-33818, CVE-2026-46600...

CLEANSTART-2026-BN89797 Security fixes in rabbitmq-messaging-topology-operator 1.20.1-r1

Package rabbitmq-messaging-topology-operator version 1.20.1-r1 fixes 1 vulnerabilities: ghsa-hrxh-6v49-42gf...

CLEANSTART-2026-PJ87430 Security fixes in rabbitmq-messaging-topology-operator 1.2.1-r1

Package rabbitmq-messaging-topology-operator version 1.2.1-r1 fixes 8 vulnerabilities: CVE-2026-39821, CVE-2026-56860, CVE-2026-56858, CVE-2026-33818, CVE-2026-46600...

PT-2026-89941

Package rabbitmq-messaging-topology-operator version 1.20.1-r1 fixes 1 vulnerabilities: ghsa-hrxh-6v49-42gf...

CVE-2026-59272

Any application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, is exposed to man-in-the-middle interception of every log event. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier...

CVE-2026-59272

Spring AMQP 's Log4j2 AmqpAppender disables TLS hostname verification by default . Any application using this appender to ship logs to RabbitMQ over TLS, while relying on the documented default, is exposed to man-in-the-middle interception of every log event. The vulnerability is rated MEDIUM (CV...

EUVD-2026-67093

Any application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, is exposed to man-in-the-middle interception of every log event. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier...

CVE-2026-59272 Log4j2 AmqpAppender disables TLS hostname verification by default

Any application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, is exposed to man-in-the-middle interception of every log event. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier...

CVE-2026-59272 Log4j2 AmqpAppender disables TLS hostname verification by default

Any application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, is exposed to man-in-the-middle interception of every log event. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier...

CVE-2026-59271

When the RabbitMQ management aliveness check fails, the configured admin password is embedded in cleartext in the thrown exception message. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier...

CVE-2026-59271 Admin password disclosed in BrokerNotAliveException message

When the RabbitMQ management aliveness check fails, the configured admin password is embedded in cleartext in the thrown exception message. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier...

EUVD-2026-66847

When the RabbitMQ management aliveness check fails, the configured admin password is embedded in cleartext in the thrown exception message. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier...

CVE-2026-59271 Admin password disclosed in BrokerNotAliveException message

When the RabbitMQ management aliveness check fails, the configured admin password is embedded in cleartext in the thrown exception message. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier...

CVE-2026-59271: Generation of Error Message Containing Sensitive Information

When the RabbitMQ management aliveness check fails, the configured admin password is embedded in cleartext in the thrown exception message. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier...