Vulnerability Summary
com.rabbitmq.client.TrustEverythingTrustManager accepts ANY TLS certificate (including null chains) and is used as the default trust manager when calling ConnectionFactory.useSslProtocol() without arguments. Combined with hostname verification being disabled by default, this enables trivial man-in-the-middle attacks.
Affected Components
com.rabbitmq.client.TrustEverythingTrustManager — accepts any certificate
com.rabbitmq.client.ConnectionFactory.useSslProtocol() — uses TrustEverythingTrustManager
- Hostname verification disabled by default (
enableHostnameVerification() must be called explicitly)
com.rabbitmq.client.ConnectionFactory.getPassword() — returns plaintext with no redaction
- Default port 5672 (plaintext) with PLAIN SASL — credentials sent unencrypted
POC (Verified on Java 21, amqp-client 5.25.0)
// TrustEverythingTrustManager accepts ANY certificate including null
TrustEverythingTrustManager tm = new TrustEverythingTrustManager();
tm.checkServerTrusted(null, "RSA"); // No exception — accepts null cert chain
tm.getAcceptedIssuers(); // Returns empty array — trusts all CAs
// ConnectionFactory defaults
ConnectionFactory factory = new ConnectionFactory();
factory.useSslProtocol(); // Uses TrustEverythingTrustManager internally
// enableHostnameVerification() NOT called by default
// Credential exposure
factory.setPassword("secret_password_123");
factory.getPassword(); // Returns "secret_password_123" — no redaction
// Default plaintext port
factory.getPort(); // 5672 (plaintext, not 5671/TLS)
// PLAIN SASL sends cleartext credentials
PlainMechanism pm = new PlainMechanism();
// handleChallenge() sends username+password in cleartext
Attack Scenarios
- MITM: Attacker presents self-signed cert →
TrustEverythingTrustManager accepts it → all RabbitMQ traffic intercepted
- Credential theft: Default plaintext port (5672) + PLAIN SASL = credentials readable on network
- DNS rebinding: No hostname verification → attacker DNS record → MITM without cert
- Logging exposure:
getPassword() returns plaintext → credentials in logs/stack traces
CVSS 3.1: 8.1 (HIGH)
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Suggested Fix
- Deprecate
TrustEverythingTrustManager — it should never be used in production
useSslProtocol() should use the JVM default trust store, not TrustEverything
- Enable hostname verification by default
- Redact password in
getPassword() or remove the public getter
- Warn when using PLAIN SASL without TLS
Note from reporter (2026-06-29): Hi, glad to see this accepted. Could a CVE ID be requested from GitHub as part of this advisory? If not yet done, would you be able to request one when publishing? Happy to help with any details needed.
Reply from reporter (2026-06-29): Thanks Arnaud. Understood on points 4 and 5 — the fix for 1, 2, 3 looks solid. Looking forward to the release and CVE assignment. Happy to help with anything else needed.
Vulnerability Summary
com.rabbitmq.client.TrustEverythingTrustManageraccepts ANY TLS certificate (including null chains) and is used as the default trust manager when callingConnectionFactory.useSslProtocol()without arguments. Combined with hostname verification being disabled by default, this enables trivial man-in-the-middle attacks.Affected Components
com.rabbitmq.client.TrustEverythingTrustManager— accepts any certificatecom.rabbitmq.client.ConnectionFactory.useSslProtocol()— uses TrustEverythingTrustManagerenableHostnameVerification()must be called explicitly)com.rabbitmq.client.ConnectionFactory.getPassword()— returns plaintext with no redactionPOC (Verified on Java 21, amqp-client 5.25.0)
Attack Scenarios
TrustEverythingTrustManageraccepts it → all RabbitMQ traffic interceptedgetPassword()returns plaintext → credentials in logs/stack tracesCVSS 3.1: 8.1 (HIGH)
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:NSuggested Fix
TrustEverythingTrustManager— it should never be used in productionuseSslProtocol()should use the JVM default trust store, not TrustEverythinggetPassword()or remove the public getterNote from reporter (2026-06-29): Hi, glad to see this accepted. Could a CVE ID be requested from GitHub as part of this advisory? If not yet done, would you be able to request one when publishing? Happy to help with any details needed.
Reply from reporter (2026-06-29): Thanks Arnaud. Understood on points 4 and 5 — the fix for 1, 2, 3 looks solid. Looking forward to the release and CVE assignment. Happy to help with anything else needed.