CVE-2026-57219

Katalog CVE

CVSS 7.5 · High EPSS 2,8%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada broadcom rabbitmq server. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the obsolete GET /api/auth endpoint can disclose the OAuth 2 client secret on RabbitMQ installations configured with management.oauth_client_secret, exposing credentials to unauthenticated callers when the management plugin and that OAuth configuration are enabled. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.

Rincian

Terbit di NVD

10 Juli 2026

Terakhir diubah

29 Juli 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-522: Insufficiently Protected Credentials

EPSS (30 hari)

2,8% peluang dieksploitasi; lebih tinggi dari 86,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-pj24-8j6m-vq9q mitigasi · advisory vendor
• https://github.com/rabbitmq/rabbitmq-server/commit/98b1daf740237c85941e8addcbea6e74f4a2743c patch
• https://github.com/rabbitmq/rabbitmq-server/commit/aa387c4451e7b674df3e3ba89df86a99d697cc7f patch
• https://github.com/rabbitmq/rabbitmq-server/pull/16083 issue tracking · patch
• https://github.com/rabbitmq/rabbitmq-server/pull/16086 issue tracking · patch
• https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6 release notes