CVE-2026-57219 Information disclosure in rabbitmq-server
Unauthenticated attackers can read OAuth client secrets via an HTTP API endpoint in RabbitMQ when specific OAuth configurations are enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-57219?
CVE-2026-57219 is a high-severity vulnerability in Broadcom Rabbitmq Server, published on 10 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the obsolete GET /api/auth endpoint can disclose the OAuth 2 client secret on RabbitMQ installations configured with management.oauth_client_secret, exposing credentials to unauthenticated callers when the management plugin and that OAuth configuration are enabled. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.
Which versions are affected by CVE-2026-57219?
It affects 1 product.
Products include Broadcom Rabbitmq Server.
How do I fix CVE-2026-57219?
Upgrade to a fixed version.
Is CVE-2026-57219 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-57219 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in Broadcom Rabbitmq Server
- CVE-2016-9877 Auth bypass in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6; RabbitMQ for PCF 1.5.x before 1.5.20, 1.6.x before 1.6.12 and 1.7.x before 1.7.7
- CVE-2026-67404 RabbitMQ: OAuth2 silent verify_none fallback for JWKS fetch
- CVE-2026-67231 RabbitMQ: Trust-store whitelist by Issuer+Serial only
- CVE-2026-67236 RabbitMQ: Plaintext username:password stored in an insecure cookie after successful POST /login
- CVE-2026-67409 RabbitMQ: JWKS Fetch Ignores HTTP Response Status Code - Signing Key Destruction Causes Authentication DoS
Sources
Also known as AZL-92334, DEBIAN-CVE-2026-57219, GHSA-pj24-8j6m-vq9q, UBUNTU-CVE-2026-57219.