CVE-2026-59272
Description
A flaw was found in the Log4j2 AMQP Appender. When configured to ship logs to RabbitMQ over Transport Layer Security (TLS), the appender disables hostname verification by default. This misconfiguration allows a remote attacker to perform a man-in-the-middle (MITM) attack, intercepting sensitive log events. This can lead to unauthorized information disclosure.
Statement
This vulnerability affects the Log4j2 AmqpAppender, a non-default, opt-in component that routes log events to a RabbitMQ broker over AMQP. No Red Hat product enables this appender by default — it requires explicit configuration by the application deployer, making exposure conditional on a deliberate architectural choice.
For Red Hat Enterprise Linux, resteasy packages in RHEL 8 bundle log4j-core as a build-time dependency but do not activate or expose the AMQP Appender at runtime. PKI deployments are not affected unless a custom Log4j2 configuration independently enables the appender.
Exploitation requires the attacker to already hold a man-in-the-middle position on the network path between the logging client and the RabbitMQ broker. That prerequisite — combined with the non-default nature of the appender — significantly limits practical exploitability in standard deployments.
Mitigation
Disable the Log4j2 AmqpAppender in log4j2.xml if it is not actively required. Where it must remain in use, ensure RabbitMQ is reachable only over a trusted internal network segment, or terminate the TLS connection through a proxy that enforces full certificate chain and hostname validation.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.8 | N/A | 6.8 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
cve.org: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Understanding the Weakness (CWE)
Integrity,Authentication
Technical Impact: Bypass Protection Mechanism; Gain Privileges or Assume Identity
When a certificate is invalid or malicious, it might allow an attacker to spoof a trusted entity by interfering in the communication path between the host and client. The product might connect to a malicious host while believing it is a trusted host, or the product might be deceived into accepting spoofed data that appears to originate from a trusted host.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
