Skip to main content

Rabbitmq CVE-2026-57219

| EUVDEUVD-2026-43021 HIGH
Information Exposure (CWE-200)
2026-07-10 GitHub_M
Information Disclosure Rabbitmq Server Rabbitmq
8.7
CVSS 4.0 · Vendor: GitHub_M
View

Vulnerability Assessment

Weakness
CWE
CWE-200
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK

2 techniques across 2 tactics: Collection, Discovery

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 10, 2026

Sensitive credential disclosure in RabbitMQ affects installations running the management plugin with OAuth 2 configured via management.oauth_client_secret, prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6. The obsolete GET /api/auth endpoint returns the configured OAuth 2 client secret to unauthenticated callers, allowing any remote party with network reach to the management interface to harvest the credential and potentially impersonate the broker to its identity provider. No public exploit identified at time of analysis, and it is not listed in CISA KEV, though the fix and root cause are fully documented in the vendor GitHub Security Advisory GHSA-pj24-8j6m-vq9q.

Affected VersionsENISA

rabbitmq-server 4.2.0, < 4.2.6
rabbitmq-server 3.13.0, < 3.13.15
rabbitmq-server 4.1.0, < 4.1.11
rabbitmq-server 4.0.0, < 4.0.21

Affected Packages

euvd rabbitmq_server_3_13_0 fix: 3.13.15
euvd rabbitmq_server_4_0_0 fix: 4.0.21
euvd rabbitmq_server_4_1_0 fix: 4.1.11
euvd rabbitmq_server_4_2_0 fix: 4.2.6

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 4 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Know when Rabbitmq gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (GitHub_M) PRIMARY 8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
SUSE HIGH
Red Hat 7.5 HIGH

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Network
Attack Complexity
Low
Attack Requirements
Present
Privileges Required
None
User Interaction
Active
Vulnerable system: Confidentiality
High
Vulnerable system: Integrity
High
Vulnerable system: Availability
None
Subsequent system: Confidentiality
High
Subsequent system: Integrity
High
Subsequent system: Availability
None

Lifecycle Timeline

1
Patch available
Jul 10, 2026 - 22:02 EUVD

DescriptionCVE.org

RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the obsolete GET /api/auth endpoint can disclose the OAuth 2 client secret on RabbitMQ installations configured with management.oauth_client_secret, exposing credentials to unauthenticated callers when the management plugin and that OAuth configuration are enabled. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.

Executive ViewAI

Why It Matters

RabbitMQ management plugin's OAuth 2 configuration exposes client secrets to unauthenticated remote attackers, enabling credential theft and potential impersonation attacks against integrated identity providers. Organizations using RabbitMQ with OAuth 2 authentication should prioritize this as it directly compromises identity infrastructure and could enable lateral movement or provider compromise.

Recommended Action

Within 24 hours: Audit all RabbitMQ instances for versions prior to 3.13.15, 4.0.20, 4.1.11, or 4.2.6; identify instances with OAuth 2 management.oauth_client_secret configured; restrict network access to management interface via firewall rules. Within 7 days: Upgrade to the patched version for your version line (3.13.15+, 4.0.20+, 4.1.11+, or 4.2.6+ respectively) and immediately rotate OAuth 2 client credentials in your identity provider. Within 30 days: Review management interface access logs for unauthorized credential queries and audit identity provider logs for unauthorized authentication attempts.

Business Impact: High
Compensating Controls

Apply vendor patch. If immediate patching is not feasible, restrict network access to management interface via firewall or VPN, disable OAuth 2 configuration if not actively required, and establish heightened monitoring on identity provider for suspicious access patterns.

Threat Intelligence Overview

EPSS Score
0.3%
Top 75% exploitable
Exploit
POC
Public exploit code exists
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC POC (1) Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC Yes
EPSS 0.3%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Partial

Priority Score

64
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +44
PoC: +20
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Rabbitmq

View all
CVE-2019-11287 HIGH POC
7.5 Nov 23

Pivotal RabbitMQ, versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, and RabbitMQ for Pivotal Platform, 1.16.x ver
CVE-2026-63335 MEDIUM POC
6.3 Aug 18

Denial of service in the RabbitMQ Java client library (com.rabbitmq:amqp-client ≤ 5.30.0) allows a malicious or compromi
CVE-2016-9877 CRITICAL
9.8 Dec 29

An issue was discovered in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6 and RabbitMQ for PCF 1.5.x before 1.
CVE-2026-77411 CRITICAL
9.5 Sep 16

Parsing desynchronization in the RabbitMQ amqp091-go AMQP 0.9.1 client library before 1.13.0 lets a malicious or comprom
CVE-2026-77405 CRITICAL
9.4 Sep 16

RabbitMQ's amqp091-go Go client library, in all versions before 1.13.0, builds TLS configuration from amqps:// URIs with
CVE-2021-32718 MEDIUM POC
5.4 Jun 28

RabbitMQ is a multi-protocol messaging broker. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploita
CVE-2026-67404 CRITICAL
9.2 Sep 23

RabbitMQ brokers that use the OAuth2 plugin can silently fall back to disabled TLS certificate verification when no CA b
CVE-2026-77408 CRITICAL
9.1 Sep 16

Silent AMQP 0.9.1 metadata corruption in the RabbitMQ amqp091-go Go client library prior to 1.13.0 lets an application t
CVE-2026-67231 CRITICAL
9.1 Sep 23

TLS client-authentication bypass in the RabbitMQ trust-store plugin lets a remote unauthenticated attacker whose forged

CVE-2026-63336 MEDIUM POC
5.1 Aug 18

TLS certificate validation is completely bypassed in the RabbitMQ Java client library (`com.rabbitmq:amqp-client`) prior
CVE-2026-77412 HIGH
8.9 Sep 16

Denial of service in the official RabbitMQ Go client library amqp091-go (versions prior to 1.13.0): a malicious, comprom
CVE-2026-77410 HIGH
8.9 Sep 16

Memory-exhaustion denial of service in the official RabbitMQ Go AMQP 0.9.1 client library (amqp091-go) prior to 1.13.0 l

Same weakness CWE-200 – Information Exposure

View all
CVE-2024-24919 HIGH POC
8.6
CVE-2021-41277 HIGH POC
7.5
CVE-2016-6415 HIGH POC
7.5
CVE-2013-7331 MEDIUM POC
6.5
CVE-2025-31125 MEDIUM POC
5.3
CVE-2025-11749 CRITICAL POC
9.8
CVE-2017-16894 HIGH POC
7.5
CVE-2017-11165 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Server Applications 15 SP7 Affected
SUSE Linux Enterprise Module for Server Applications 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:35939 ADVISORY https://access.redhat.com/errata/RHSA-2026:35940 ADVISORY https://vuldb.com/vuln/377634 REF https://github.com/rabbitmq/rabbitmq-server/commit/98b1daf740237c85941e8addcbea6e74f4a2743c REF https://github.com/rabbitmq/rabbitmq-server/commit/aa387c4451e7b674df3e3ba89df86a99d697cc7f REF https://github.com/rabbitmq/rabbitmq-server/pull/16083 REF https://github.com/rabbitmq/rabbitmq-server/pull/16086 REF https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6 REF https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-pj24-8j6m-vq9q

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy