RabbitMQ Java client: TrustEverythingTrustManager used by default in useSslProtocol() enables MITM
Vulnerability Summary
com.rabbitmq.client.TrustEverythingTrustManager accepts ANY TLS certificate (including null chains) and is used as the default trust manager when calling ConnectionFactory.useSslProtocol() without arguments. Combined with hostname verification being disabled by default, this enables trivial man-in-the-middle attacks.
Affected Components
com.rabbitmq.client.TrustEverythingTrustManager— accepts any certificatecom.rabbitmq.client.ConnectionFactory.useSslProtocol()— uses TrustEverythingTrustManager- Hostname verification disabled by default (
enableHostnameVerification()must be called explicitly) com.rabbitmq.client.ConnectionFactory.getPassword()— returns plaintext with no redaction- Default port 5672 (plaintext) with PLAIN SASL — credentials sent unencrypted
POC (Verified on Java 21, amqp-client 5.25.0)
// TrustEverythingTrustManager accepts ANY certificate including null
TrustEverythingTrustManager tm = new TrustEverythingTrustManager();
tm.checkServerTrusted(null, "RSA"); // No exception — accepts null cert chain
tm.getAcceptedIssuers(); // Returns empty array — trusts all CAs
// ConnectionFactory defaults
ConnectionFactory factory = new ConnectionFactory();
factory.useSslProtocol(); // Uses TrustEverythingTrustManager internally
// enableHostnameVerification() NOT called by default
// Credential exposure
factory.setPassword("secret_password_123");
factory.getPassword(); // Returns "secret_password_123" — no redaction
// Default plaintext port
factory.getPort(); // 5672 (plaintext, not 5671/TLS)
// PLAIN SASL sends cleartext credentials
PlainMechanism pm = new PlainMechanism();
// handleChallenge() sends username+password in cleartextAttack Scenarios
- MITM: Attacker presents self-signed cert →
TrustEverythingTrustManageraccepts it → all RabbitMQ traffic intercepted - Credential theft: Default plaintext port (5672) + PLAIN SASL = credentials readable on network
- DNS rebinding: No hostname verification → attacker DNS record → MITM without cert
- Logging exposure:
getPassword()returns plaintext → credentials in logs/stack traces
Suggested Fix
- Deprecate
TrustEverythingTrustManager— it should never be used in production useSslProtocol()should use the JVM default trust store, not TrustEverything- Enable hostname verification by default
- Redact password in
getPassword()or remove the public getter - Warn when using PLAIN SASL without TLS
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Java / Kotlin (Maven) | com.rabbitmq:amqp-client | < 5.33.0 | 5.33.0 |
Referencias
- https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-5m9f-rphj-c435
- https://github.com/rabbitmq/rabbitmq-java-client/pull/1999
- https://github.com/rabbitmq/rabbitmq-java-client/pull/2001
- https://github.com/rabbitmq/rabbitmq-java-client/commit/1e7deb2e6020c9793a81385a53ea378ec63b9339
- https://github.com/rabbitmq/rabbitmq-java-client/commit/a4bf571dd368765baaa9cecfae68ce09f1bdcc01
- https://github.com/rabbitmq/rabbitmq-java-client
- https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.33.0
- Vector CVSS
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N- Debilidad (CWE)
CWE-295- Plataforma
- Java / Kotlin (Maven)
- Paquete
com.rabbitmq:amqp-client- Publicada
- 18.08.2026
- Actualizado
- 11.10.2026 13:20
Fuentes y licencias
OSV / GitHub Advisory Database - GHSA-5m9f-rphj-c435 - CC BY 4.0
Historial de vulnerabilidades: com.rabbitmq:amqp-client
Todas las vulnerabilidades publicadas de este paquete (Java / Kotlin (Maven)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 12
- Primera → última
- 10.2018 10.2026
- Sin corrección
- 0
- Explotada en ataques
- 0
Distribución por gravedad
- Alta 4
- Media 7
- Baja 1
Divulgaciones por año
- 2018: 1
- 2019: 0
- 2020: 0
- 2021: 0
- 2022: 0
- 2023: 1
- 2024: 0
- 2025: 0
- 2026: 10
-
RabbitMQ Java client: TrustEverythingTrustManager used by default in useSslProtocol() enables MITM esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.