CVE-2026-59272

A flaw was found in the Log4j2 AMQP Appender. When configured to ship logs to RabbitMQ over Transport Layer Security (TLS), the appender disables hostname verification by default. This misconfiguration allows a remote attacker to perform a man-in-the-middle (MITM) attack, intercepting sensitive log events. This can lead to unauthorized information disclosure.

This vulnerability affects the Log4j2 AmqpAppender, a non-default, opt-in component that routes log events to a RabbitMQ broker over AMQP. No Red Hat product enables this appender by default — it requires explicit configuration by the application deployer, making exposure conditional on a deliberate architectural choice.

For Red Hat Enterprise Linux, resteasy packages in RHEL 8 bundle log4j-core as a build-time dependency but do not activate or expose the AMQP Appender at runtime. PKI deployments are not affected unless a custom Log4j2 configuration independently enables the appender.

Exploitation requires the attacker to already hold a man-in-the-middle position on the network path between the logging client and the RabbitMQ broker. That prerequisite — combined with the non-default nature of the appender — significantly limits practical exploitability in standard deployments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Disable the Log4j2 AmqpAppender in log4j2.xml if it is not actively required. Where it must remain in use, ensure RabbitMQ is reachable only over a trusted internal network segment, or terminate the TLS connection through a proxy that enforces full certificate chain and hostname validation.