THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-5m9f-rphj-c435 (medium) — RabbitMQ Java client: TrustEverythingTrustManager used by default in useSslProtocol() enables MITM

[GHSA] GHSA-5m9f-rphj-c435 (medium) — RabbitMQ Java client: TrustEverythingTrustManager used by default in useSslProtocol() enables MITM

medgithub_advisoriesPublished 2026-08-18

GHSA-5m9f-rphj-c435 Severity: medium CVE: CVE-2026-63336

RabbitMQ Java client: TrustEverythingTrustManager used by default in useSslProtocol() enables MITM

## Vulnerability Summary

`com.rabbitmq.client.TrustEverythingTrustManager` accepts ANY TLS certificate (including null chains) and is used as the default trust manager when calling `ConnectionFactory.useSslProtocol()` without arguments. Comb

MITRE ATT&CK techniques

CredentialsT1589.001

Indicators of compromise

CVE-2026-63336cve

Original source: https://github.com/advisories/GHSA-5m9f-rphj-c435