Vulnerability Description
RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the obsolete GET /api/auth endpoint can disclose the OAuth 2 client secret on RabbitMQ installations configured with management.oauth_client_secret, exposing credentials to unauthenticated callers when the management plugin and that OAuth configuration are enabled. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Broadcom | Rabbitmq Server | >= 3.13.0, < 4.2.6 |
Related Weaknesses (CWE)
References
- https://github.com/rabbitmq/rabbitmq-server/commit/98b1daf740237c85941e8addcbea6Patch
- https://github.com/rabbitmq/rabbitmq-server/commit/aa387c4451e7b674df3e3ba89df86Patch
- https://github.com/rabbitmq/rabbitmq-server/pull/16083Issue TrackingPatch
- https://github.com/rabbitmq/rabbitmq-server/pull/16086Issue TrackingPatch
- https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6Release Notes
- https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-pj24-8j6m-vMitigationVendor Advisory
FAQ
What is CVE-2026-57219?
CVE-2026-57219 is a vulnerability with a CVSS score of 7.5 (HIGH). RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the obsolete GET /api/auth endpoint can disclose the OAuth 2 client secret on RabbitMQ installations configur...
How severe is CVE-2026-57219?
CVE-2026-57219 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-57219?
Check the references section above for vendor advisories and patch information. Affected products include: Broadcom Rabbitmq Server.