CVE-2026-57219

RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the obsolete GET /api/auth endpoint can disclose the OAuth 2 client secret on RabbitMQ installations configured with management.oauth_client_secret, exposing credentials to unauthenticated callers when the management plugin and that OAuth configuration are enabled. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/rabbitmq/rabbitmq-server/commit/98b1daf740237c85941e8addcbea6e74f4a2743c	Patch
https://github.com/rabbitmq/rabbitmq-server/commit/aa387c4451e7b674df3e3ba89df86a99d697cc7f	Patch
https://github.com/rabbitmq/rabbitmq-server/pull/16083	Issue Tracking Patch
https://github.com/rabbitmq/rabbitmq-server/pull/16086	Issue Tracking Patch
https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6	Release Notes
https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-pj24-8j6m-vq9q	Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*

History

25 Oct 2026, 15:10

Type	Values Removed	Values Added
Summary		(es) RabbitMQ es un broker de mensajería y streaming. Antes de las versiones 3.13.15, 4.0.20, 4.1.11 y 4.2.6, el endpoint obsoleto GET /API/auth puede divulgar el secreto del cliente OAuth 2 en instalaciones de RabbitMQ configuradas con management.oauth_client_secret, exponiendo credenciales a llamadores no autenticados cuando el plugin de gestión y esa configuración de OAuth están habilitados. Este problema está solucionado en las versiones 3.13.15, 4.0.20, 4.1.11 y 4.2.6.

Information

Published : 2026-07-10 21:16

Updated : 2026-10-25 15:10

NVD link : CVE-2026-57219

Mitre link : CVE-2026-57219

CVE.ORG link : CVE-2026-57219

JSON object : View

Products Affected

broadcom

rabbitmq_server

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CWE-522

Insufficiently Protected Credentials

{"id": "CVE-2026-57219", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-57219", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-16T03:55:25.368000Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "rabbitmq", "product": "rabbitmq-server", "versions": [{"status": "affected", "version": ">= 4.2.0, < 4.2.6"}, {"status": "affected", "version": ">= 4.1.0, < 4.1.11"}, {"status": "affected", "version": ">= 4.0.0, < 4.0.21"}, {"status": "affected", "version": ">= 3.13.0, < 3.13.15"}]}]}], "published": "2026-07-10T21:16:59.060", "references": [{"url": "https://github.com/rabbitmq/rabbitmq-server/commit/98b1daf740237c85941e8addcbea6e74f4a2743c", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/rabbitmq/rabbitmq-server/commit/aa387c4451e7b674df3e3ba89df86a99d697cc7f", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/rabbitmq/rabbitmq-server/pull/16083", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/rabbitmq/rabbitmq-server/pull/16086", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-pj24-8j6m-vq9q", "tags": ["Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-200"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-522"}]}], "descriptions": [{"lang": "en", "value": "RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the obsolete GET /api/auth endpoint can disclose the OAuth 2 client secret on RabbitMQ installations configured with management.oauth_client_secret, exposing credentials to unauthenticated callers when the management plugin and that OAuth configuration are enabled. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6."}, {"lang": "es", "value": "RabbitMQ es un broker de mensajer\u00eda y streaming. Antes de las versiones 3.13.15, 4.0.20, 4.1.11 y 4.2.6, el endpoint obsoleto GET /API/auth puede divulgar el secreto del cliente OAuth 2 en instalaciones de RabbitMQ configuradas con management.oauth_client_secret, exponiendo credenciales a llamadores no autenticados cuando el plugin de gesti\u00f3n y esa configuraci\u00f3n de OAuth est\u00e1n habilitados. Este problema est\u00e1 solucionado en las versiones 3.13.15, 4.0.20, 4.1.11 y 4.2.6."}], "lastModified": "2026-10-25T15:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6B5BD560-DF1B-43F3-BC3C-212B06A9BB64", "versionEndExcluding": "4.2.6", "versionStartIncluding": "3.13.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}