Vulnerability · Published Aug 18, 2026 · Assigned by GitHub_M

CVE-2026-63336RabbitMQ Java client: TrustEverythingTrustManager used by default in useSslProtocol() enables MITM

Medium 5.1

In plain English

A medium-severity improper certificate validation in rabbitmq-java-client from rabbitmq. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)5.1Medium

Exploit odds (30 days)0.3%top 76.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, com.rabbitmq.client.ConnectionFactory.useSslProtocol() and ConnectionFactory.useSslProtocol(String) configure com.rabbitmq.client.TrustEverythingTrustManager and leave hostname verification disabled, causing arbitrary server certificates, including self-signed certificates, to be accepted. A network attacker able to intercept a TLS connection can impersonate the RabbitMQ broker, read protected AMQP traffic, and modify traffic without certificate or hostname validation. The fix changes the production TLS helpers to use the JVM default trust store and enables hostname verification, while retaining an explicitly named development-only no-verification helper. This issue is fixed in version 5.33.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	rabbitmq-java-client	no fix listed	DEBIAN-CVE-2026-63336
Debian:13	rabbitmq-java-client	no fix listed	DEBIAN-CVE-2026-63336
Maven	com.rabbitmq:amqp-client	5.33.0	GHSA-5m9f-rphj-c435
Ubuntu:22.04:LTS	rabbitmq-java-client	no fix listed	UBUNTU-CVE-2026-63336
Ubuntu:24.04:LTS	rabbitmq-java-client	no fix listed	UBUNTU-CVE-2026-63336
Ubuntu:26.04:LTS	rabbitmq-java-client	no fix listed	UBUNTU-CVE-2026-63336
Ubuntu:26.10	rabbitmq-java-client	no fix listed	UBUNTU-CVE-2026-63336

Affected products (as reported)

Vendor	Product	Versions
rabbitmq	rabbitmq-java-client	< 5.33.0

Weakness: CWE-295 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N

References

https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-5m9f-rphj-c435 x_refsource_CONFIRM
https://github.com/rabbitmq/rabbitmq-java-client/pull/1999 x_refsource_MISC
https://github.com/rabbitmq/rabbitmq-java-client/pull/2001 x_refsource_MISC
https://github.com/rabbitmq/rabbitmq-java-client/commit/1e7deb2e6020c9793a81385a53ea378ec63b9339 x_refsource_MISC
https://github.com/rabbitmq/rabbitmq-java-client/commit/a4bf571dd368765baaa9cecfae68ce09f1bdcc01 x_refsource_MISC
https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.33.0 x_refsource_MISC