MEDIUM GitHub
CVE-2026-63336
RabbitMQ Java client: TrustEverythingTrustManager used by default in useSslProtocol() enables MITM
## Vulnerability Summary
`com.rabbitmq.client.TrustEverythingTrustManager` accepts ANY TLS certificate (including null chains) and is used as the default trust manager when calling `ConnectionFactory.useSslProtocol()` without arguments. Combined with hostname verification being disabled by default, this enables trivial man-in-the-middle attacks.
## Affected Components
- `com.rabbitmq.client.TrustEverythingTrustManager` — accepts any certificate
- `com.rabbitmq.client.ConnectionFactory.useSslP
Affected Products
- maven/com.rabbitmq:amqp-client < 5.33.0
References
- https://github.com/advisories/GHSA-5m9f-rphj-c435
- https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-5m9f-rphj-c435
- https://github.com/rabbitmq/rabbitmq-java-client/pull/1999
- https://github.com/rabbitmq/rabbitmq-java-client/pull/2001
This medium severity vulnerability was published on 2026-08-18 via GitHub. Affected: maven/com.rabbitmq:amqp-client < 5.33.0.
vulnfeed aggregates 11140 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.