The weakness manifests when RabbitMQ’s management aliveness check fails, causing a BrokerNotAliveException that appends the configured admin password in cleartext. An attacker who can read the exception output or associated logs can obtain the administrative credentials, enabling unauthorized access to the broker and potentially compromising data confidentiality and integrity. This is a classic information‑exposure flaw identified as CWE‑200.

Spring AMQP 4.1.0, Spring AMQP 4.0.0 through 4.0.4, Spring AMQP 3.2.0 through 3.2.12, and Spring AMQP 2.4.18 and all earlier releases.

The CVSS score of 5.3 rates the vulnerability as moderate. No EPSS score is available, suggesting limited publicly documented exploitation activity, and the issue is not listed in CISA’s KEV catalog. Exploitation requires an attacker to trigger the aliveness check failure and gain visibility of the exception message—either through an exposed log file or an application that surfaces the exception. While the attack vector is more limited than remote code execution, the potential impact of leaking administrator credentials can be significant for compromised RabbitMQ instances.