CVE-2026-57219
published 2026-07-10CVE-2026-57219: RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the obsolete GET /api/auth endpoint can disclose the OAuth 2 client…
PriorityP265high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EXPLOIT
EPSS
2.84%
86.6th percentile
RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the obsolete GET /api/auth endpoint can disclose the OAuth 2 client secret on RabbitMQ installations configured with management.oauth_client_secret, exposing credentials to unauthenticated callers when the management plugin and that OAuth configuration are enabled. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| broadcom | rabbitmq_server | >= 3.13.0 < 4.2.6 | 4.2.6 |
| rabbitmq | rabbitmq-server | — | — |
| rabbitmq | rabbitmq-server | — | — |
| rabbitmq | rabbitmq-server | — | — |
| rabbitmq | rabbitmq-server | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
RabbitMQ: RabbitMQ: OAuth 2 client secret disclosure via obsolete API endpoint
vendor_redhat·2026-07-10·CVSS 7.5
CVE-2026-57219 [HIGH] CWE-477 RabbitMQ: RabbitMQ: OAuth 2 client secret disclosure via obsolete API endpoint
RabbitMQ: RabbitMQ: OAuth 2 client secret disclosure via obsolete API endpoint
RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the obsolete GET /api/auth endpoint can disclose the OAuth 2 client secret on RabbitMQ installations configured with management.oauth_client_secret, exposing credentials to unauthenticated callers when the management plugin and that OAuth configuration are enabled. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.
A flaw was found in RabbitMQ, a messaging and streaming broker. An unauthenticated remote attacker could exploit an obsolete API endpoint (GET /api/auth) to disclose the OAuth 2 client secret. This vulnerability occurs when the RabbitMQ management plugin and OAuth configuration are enabled, le
VulDB
RabbitMQ Server up to 3.13.14/4.0.19/4.1.10/4.2.5 Auth Endpoint /api/auth information disclosure
vuldb·2026-07-10·CVSS 8.7
CVE-2026-57219 [HIGH] RabbitMQ Server up to 3.13.14/4.0.19/4.1.10/4.2.5 Auth Endpoint /api/auth information disclosure
A vulnerability marked as problematic has been reported in RabbitMQ Server up to 3.13.14/4.0.19/4.1.10/4.2.5. This vulnerability affects unknown code of the file /api/auth of the component Auth Endpoint. The manipulation leads to information disclosure.
This vulnerability is listed as CVE-2026-57219. The attack may be initiated remotely. There is no available exploit.
No detection rules found.
Nuclei
RabbitMQ Management - OAuth 2 Client Secret Disclosure
nuclei·CVSS 7.5
CVE-2026-57219 [HIGH] RabbitMQ Management - OAuth 2 Client Secret Disclosure
RabbitMQ Management - OAuth 2 Client Secret Disclosure
RabbitMQ < 3.13.15, 4.0.20, 4.1.11, and 4.2.6 contains an information disclosure caused by the obsolete GET /api/auth endpoint exposing OAuth 2 client secrets when management.oauth_client_secret is configured, letting unauthenticated attackers access sensitive credentials, exploit requires management plugin and OAuth configuration enabled.
Template:
id: CVE-2026-57219
info:
name: RabbitMQ Management - OAuth 2 Client Secret Disclosure
author: aryu-ru
severity: high
description: |
RabbitMQ < 3.13.15, 4.0.20, 4.1.11, and 4.2.6 contains an information disclosure caused by the obsolete GET /api/auth endpoint exposing OAuth 2 client secrets when management.oauth_client_secret is configured, letting unauthenticated attackers access sensit
Hackernews
⚡ Weekly Recap: WordPress RCE, SonicWall 0-Days, AI Service Attacks, SharePoint 0-Day and More
blogs_hackernews·2026-07-20·CVSS 5.9
CVE-2026-63030 [MEDIUM] ⚡ Weekly Recap: WordPress RCE, SonicWall 0-Days, AI Service Attacks, SharePoint 0-Day and More
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: WordPress RCE, SonicWall 0-Days, AI Service Attacks, SharePoint 0-Day and More
A single request should not be able to do this much. But this week, small inputs led to code execution, memory loss, stolen keys, and disabled security tools.
The paths were often simple: exposed systems, weak checks, old drivers, fake prompts, and public code used for malware delivery. Some bugs were new. Others were already being used before defenders had time to patch.
Here is the full recap of what broke, what was exploited, and what needs attention now.
## ⚡ Threat of the Week
New wp2shell WordPress Core Flaw Lets Unauthe
Hackernews
RabbitMQ Flaws Could Leak OAuth Secrets and Expose Cross-Tenant Queue Metadata
blogs_hackernews·2026-07-14·CVSS 7.5
CVE-2026-57219 [HIGH] RabbitMQ Flaws Could Leak OAuth Secrets and Expose Cross-Tenant Queue Metadata
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## RabbitMQ Flaws Could Leak OAuth Secrets and Expose Cross-Tenant Queue Metadata
Cybersecurity researchers have disclosed details of two access control-related flaws impacting the RabbitMQ message broker service that could allow attackers to leak OAuth client secrets, expose enterprise messaging infrastructure to takeover risks, and bypass tenant boundaries.
Miggo's security team, which discovered and reported the flaws, said one "leaks the broker's confidential OAuth secret to an unauthenticated attacker in a single request, a direct path to full broker takeover in the configurations that use that secret." The second vulnerab
Bugzilla
CVE-2026-57219 rabbitmq-server: RabbitMQ: OAuth 2 client secret disclosure via obsolete API endpoint [fedora-all]
bugzilla·2026-07-28·CVSS 7.5
CVE-2026-57219 [HIGH] CVE-2026-57219 rabbitmq-server: RabbitMQ: OAuth 2 client secret disclosure via obsolete API endpoint [fedora-all]
CVE-2026-57219 rabbitmq-server: RabbitMQ: OAuth 2 client secret disclosure via obsolete API endpoint [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the obsolete GET /api/auth endpoint can disclose the OAuth 2 client secret on RabbitMQ installations configured with management.oauth_client_secret, exposing credentials to unauthenticated callers when the management plugin and that OAuth configuration are enabled. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.
Bugzilla
CVE-2026-57219 RabbitMQ: RabbitMQ: OAuth 2 client secret disclosure via obsolete API endpoint
bugzilla·2026-07-10·CVSS 7.5
CVE-2026-57219 [HIGH] CVE-2026-57219 RabbitMQ: RabbitMQ: OAuth 2 client secret disclosure via obsolete API endpoint
CVE-2026-57219 RabbitMQ: RabbitMQ: OAuth 2 client secret disclosure via obsolete API endpoint
RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the obsolete GET /api/auth endpoint can disclose the OAuth 2 client secret on RabbitMQ installations configured with management.oauth_client_secret, exposing credentials to unauthenticated callers when the management plugin and that OAuth configuration are enabled. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.
https://github.com/rabbitmq/rabbitmq-server/commit/98b1daf740237c85941e8addcbea6e74f4a2743chttps://github.com/rabbitmq/rabbitmq-server/commit/aa387c4451e7b674df3e3ba89df86a99d697cc7fhttps://github.com/rabbitmq/rabbitmq-server/pull/16083https://github.com/rabbitmq/rabbitmq-server/pull/16086https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-pj24-8j6m-vq9q
2026-07-10
Published