HIGHFixed upstream

CVE-2026-57219

RabbitMQ GET /api/auth discloses the OAuth 2 client secret without authentication

Technology

RabbitMQ

CVSS Score

7.5 / 10.0

Affected Versions

3.13.0 to 3.13.14; 4.0.0 to 4.0.19; 4.1.0 to 4.1.10; 4.2.0 to 4.2.5

Upstream Fix

4.2.6 (public); 3.13.15, 4.0.20, 4.1.11 (commercial)

Published

July 10, 2026

OSSeva Coverage

Fixed upstream

Description

On installations with the management plugin and management.oauth_client_secret configured, the obsolete GET /api/auth endpoint returned the OAuth 2 client secret to unauthenticated callers. Fixed in 4.2.6 and in the commercial 3.13.15, 4.0.20 and 4.1.11.

Upstream record: NVD · CVE.org

Is your RabbitMQ deployment affected?

If you're running 3.13.0 to 3.13.14; 4.0.0 to 4.0.19; 4.1.0 to 4.1.10; 4.2.0 to 4.2.5, you need this patch. Book a discovery call to get covered.

Book a discovery call View RabbitMQ coverage →