When RabbitMQ’s liveness check fails, the exception that is thrown includes the configured admin password in clear text. This information‑exposure flaw, identified as CWE‑209, allows an adversary who can read the exception output or logs accessed through the application to retrieve the broker’s administrative credentials. With those credentials, the attacker could gain full control over the RabbitMQ instance, compromising confidentiality and integrity of the data it transports.

Spring AMQP 4.1.0, Spring AMQP 4.0.0 through 4.0.4, Spring AMQP 3.2.0 through 3.2.12, and Spring AMQP 2.4.18 and all earlier releases.

The CVSS score of 5.3 rates this vulnerability as moderate. The EPSS score is less than 1%, indicating a very low likelihood of public exploitation. It is not listed in the CISA KEV catalog. Attackers must trigger a failed aliveness check and gain access to the exception message or associated logs, which limits the attack surface to exposed logs or applications that surface the exception. Even so, disclosure of administrator credentials can have significant impact on a compromised RabbitMQ instance.