## cve-2026-59272 - MEDIUM - Log4j2 AmqpAppender disables TLS hostname verification by default

- 種別: advisory
- 関連技術: spring, java
- CVE: CVE-2026-59272
- 公開日時: 2026-08-20T00:00:00.000Z
- 情報源: Spring Security Advisories (https://spring.io/security/cve-2026-59272)
- パーマリンク: https://vulnpulse.app/items/spring-security-07fec267277b

Any application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, is exposed to man-in-the-middle interception of every log event. Attackers on the network path can read or alter log traffic (often containing tokens, PII, or stack traces with secrets) without certificate errors. The docs promise hostname verification is on by default, so operators have no reason to suspect exposure.