In Spring AMQP the RabbitConnectionFactoryBean.setUri("amqps://...") bypasses secure SSL setup, uses TrustEverythingTrustManager
CVE-2026-41714

4MEDIUM

Key Information:

Vendor

Spring

Status
Spring AMQp
Vendor
CVE Published:
9 June 2026

What is CVE-2026-41714?

Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri("amqps://...") without also calling setUseSSL(true) get TLS encryption with no certificate validation and no hostname verification.

Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.

Affected Version(s)

Spring AMQP 4.0.0 < 4.0.4

Spring AMQP 3.2.0 < 3.2.11

Spring AMQP 3.1.0 < 3.1.16

References

https://spring.io/security/cve-2026-41714

CVSS V3.1

Score:
4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.