Loading vulnerability…
Unauthenticated OAuth Client Secret Disclosure in RabbitMQ Management
CVE-2026-57219 is an unauthenticated credential-disclosure vulnerability in the RabbitMQ management plugin. An obsolete authentication-settings endpoint permits anonymous requests because its is_authorized/2 handler returns true. The produce_auth_settings/2 function serializes the configured management.oauth_client_secret value into the response, exposing the confidential OAuth 2 client secret to anyone able to reach the management interface. Affected deployments have the management plugin enabled and use the client-secret-based OAuth configuration. Fixed releases include RabbitMQ 3.13.15, 4.0.20, 4.1.11, and 4.2.6.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An unauthenticated remote attacker can obtain the broker's OAuth client secret and associated OAuth configuration. Depending on the identity provider's permitted grants, scopes, and client privileges, the stolen credentials may allow the attacker to impersonate the configured OAuth client and obtain an administrative token. In such deployments, this can lead to full broker takeover, including access to or modification of messages, control over queues, creation of users, and changes to broker settings. Administrative access is configuration-dependent rather than an unconditional consequence of secret disclosure.
If you can’t patch tonight, do this now.
Until patching is complete, restrict the management interface, commonly exposed on port 15672, to trusted administrative networks and block untrusted access to GET /api/auth. Where operationally feasible, disable the management plugin or the affected OAuth integration, or migrate to a supported public-client configuration using PKCE without a configured client secret. Monitor management API requests and identity-provider activity for suspicious access or token issuance.
Patch, then assume compromise.
Upgrade to RabbitMQ 3.13.15, 4.0.20, 4.1.11, 4.2.6, or a later supported release containing the fix. Update pinned container images and embedded RabbitMQ deployments as applicable. The fix removes the obsolete GET /api/auth route; patched brokers return HTTP 404 for that endpoint. After patching, rotate potentially exposed OAuth client secrets at the identity provider and update the corresponding RabbitMQ configuration. Patching alone does not invalidate previously disclosed secrets.
No public exploits tracked yet. Mallory keeps watching.
29 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.