RabbitMQ flaw exposed OAuth client secrets via obsolete management API endpoint

RabbitMQ fixed a high-severity information disclosure vulnerability, CVE-2026-57219, that could let unauthenticated attackers retrieve OAuth 2 client secrets through the obsolete management API endpoint GET /api/auth. The issue affects deployments with the management plugin enabled and management.oauth_client_secret configured in certain less common OAuth 2 setups. Affected versions are >= 3.13.0 and < 3.13.15, >= 4.0.0 and < 4.0.21, >= 4.1.0 and < 4.1.11, and >= 4.2.0 and < 4.2.6; the flaw is rated CVSS 4.0 8.7 and is classified under CWE-200.

The vendor addressed the exposure in RabbitMQ 3.13.15, 4.0.20, 4.1.11, and 4.2.6. RabbitMQ 4.2.6 was released as a maintenance update with broader security-relevant hardening, including improved permission enforcement, access control, API behavior, WebSocket safety limits, login timeout handling, origin validation, and protections against excessive CPU and memory consumption from malformed inputs. The release also removed the deprecated unused API endpoint tied to the disclosure risk and reduced exposure of sensitive connection URI data in shovel status output, with users advised to upgrade and verify supported Erlang versions before deployment.