HIGHFixed upstream

CVE-2026-67410

RabbitMQ management UI exposes the OAuth 2 client secret through an unauthenticated JavaScript file

Technology

RabbitMQ

CVSS Score

8.2 / 10.0

Affected Versions

4.2.0 to 4.2.8; 4.3.0 to 4.3.2

Upstream Fix

4.2.9 and 4.3.3 (public)

Published

September 25, 2026

OSSeva Coverage

Fixed upstream

Description

When OAuth 2 sign-in is enabled for the management UI with a flow that uses a client secret, the secret is written into /js/oidc-oauth/bootstrap.js, which the broker serves without authentication. Anyone who can reach the management port can read the secret and use it to act as the OAuth 2 client.

Upstream record: NVD · CVE.org

Is your RabbitMQ deployment affected?

If you're running 4.2.0 to 4.2.8; 4.3.0 to 4.3.2, you need this patch. Book a discovery call to get covered.

Book a discovery call View RabbitMQ coverage →