CVE-2026-9133 Arbitrary file read in rabbitmq-aws plugin
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-9133?
CVE-2026-9133 is a high-severity vulnerability in RabbitMQ AWS, published on 20 May 2026.
Official description
Active debug code exists in the ARN resolver of amazon-mq rabbitmq-aws before version 0.2.1. A debug ARN scheme (arn:aws-debug:file) accepted by the PUT /api/aws/arn/validate validation endpoint might allow remote authenticated users to perform arbitrary file reads on any file accessible to the RabbitMQ process.
To remediate this issue, customers should upgrade to version 0.2.1 of rabbitmq-aws. If RabbitMQ is configured to use TLS for connections, we also recommend rotating any associated private certificate keys.
Weakness: CWE-489
Which versions are affected by CVE-2026-9133?
How do I fix CVE-2026-9133?
No fix has been published for CVE-2026-9133 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-9133 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-9133 exists.
Public exploit code: 1 Nuclei template.
Sources
Also known as GHSA-8554-wg4r-7hxm.