CVE-2026-57219

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-57219", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-24T02:21:33.810Z", "datePublished": "2026-07-10T20:22:26.516Z", "dateUpdated": "2026-07-29T19:26:44.962Z"}, "containers": {"cna": {"title": "RabbitMQ: Unauthenticated disclosure of OAuth client credentials via an HTTP API endpoint with certain less common OAuth 2 configurations", "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "lang": "en", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-pj24-8j6m-vq9q", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-pj24-8j6m-vq9q"}, {"name": "https://github.com/rabbitmq/rabbitmq-server/pull/16083", "tags": ["x_refsource_MISC"], "url": "https://github.com/rabbitmq/rabbitmq-server/pull/16083"}, {"name": "https://github.com/rabbitmq/rabbitmq-server/pull/16086", "tags": ["x_refsource_MISC"], "url": "https://github.com/rabbitmq/rabbitmq-server/pull/16086"}, {"name": "https://github.com/rabbitmq/rabbitmq-server/commit/98b1daf740237c85941e8addcbea6e74f4a2743c", "tags": ["x_refsource_MISC"], "url": "https://github.com/rabbitmq/rabbitmq-server/commit/98b1daf740237c85941e8addcbea6e74f4a2743c"}, {"name": "https://github.com/rabbitmq/rabbitmq-server/commit/aa387c4451e7b674df3e3ba89df86a99d697cc7f", "tags": ["x_refsource_MISC"], "url": "https://github.com/rabbitmq/rabbitmq-server/commit/aa387c4451e7b674df3e3ba89df86a99d697cc7f"}, {"name": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6", "tags": ["x_refsource_MISC"], "url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6"}], "affected": [{"vendor": "rabbitmq", "product": "rabbitmq-server", "versions": [{"version": ">= 4.2.0, < 4.2.6", "status": "affected"}, {"version": ">= 4.1.0, < 4.1.11", "status": "affected"}, {"version": ">= 4.0.0, < 4.0.21", "status": "affected"}, {"version": ">= 3.13.0, < 3.13.15", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-10T20:22:26.516Z"}, "descriptions": [{"lang": "en", "value": "RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the obsolete GET /api/auth endpoint can disclose the OAuth 2 client secret on RabbitMQ installations configured with management.oauth_client_secret, exposing credentials to unauthenticated callers when the management plugin and that OAuth configuration are enabled. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6."}], "source": {"advisory": "GHSA-pj24-8j6m-vq9q", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-57219", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-16T03:55:25.368000Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-29T19:26:44.962Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-57219", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-16T03:55:25.368000Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-14T14:03:07.900Z"}}], "cna": {"title": "RabbitMQ: Unauthenticated disclosure of OAuth client credentials via an HTTP API endpoint with certain less common OAuth 2 configurations", "source": {"advisory": "GHSA-pj24-8j6m-vq9q", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "rabbitmq", "product": "rabbitmq-server", "versions": [{"status": "affected", "version": ">= 4.2.0, < 4.2.6"}, {"status": "affected", "version": ">= 4.1.0, < 4.1.11"}, {"status": "affected", "version": ">= 4.0.0, < 4.0.21"}, {"status": "affected", "version": ">= 3.13.0, < 3.13.15"}]}], "references": [{"url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-pj24-8j6m-vq9q", "name": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-pj24-8j6m-vq9q", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/rabbitmq/rabbitmq-server/pull/16083", "name": "https://github.com/rabbitmq/rabbitmq-server/pull/16083", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/rabbitmq/rabbitmq-server/pull/16086", "name": "https://github.com/rabbitmq/rabbitmq-server/pull/16086", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/rabbitmq/rabbitmq-server/commit/98b1daf740237c85941e8addcbea6e74f4a2743c", "name": "https://github.com/rabbitmq/rabbitmq-server/commit/98b1daf740237c85941e8addcbea6e74f4a2743c", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/rabbitmq/rabbitmq-server/commit/aa387c4451e7b674df3e3ba89df86a99d697cc7f", "name": "https://github.com/rabbitmq/rabbitmq-server/commit/aa387c4451e7b674df3e3ba89df86a99d697cc7f", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6", "name": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the obsolete GET /api/auth endpoint can disclose the OAuth 2 client secret on RabbitMQ installations configured with management.oauth_client_secret, exposing credentials to unauthenticated callers when the management plugin and that OAuth configuration are enabled. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-10T20:22:26.516Z"}}}, "cveMetadata": {"cveId": "CVE-2026-57219", "state": "PUBLISHED", "dateUpdated": "2026-07-29T19:26:44.962Z", "dateReserved": "2026-06-24T02:21:33.810Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-10T20:22:26.516Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "rabbitmq-server", "vendor": "rabbitmq", "versions": [{"status": "affected", "version": ">= 4.2.0, < 4.2.6"}, {"status": "affected", "version": ">= 4.1.0, < 4.1.11"}, {"status": "affected", "version": ">= 4.0.0, < 4.0.21"}, {"status": "affected", "version": ">= 3.13.0, < 3.13.15"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "6B5BD560-DF1B-43F3-BC3C-212B06A9BB64", "versionEndExcluding": "4.2.6", "versionStartIncluding": "3.13.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the obsolete GET /api/auth endpoint can disclose the OAuth 2 client secret on RabbitMQ installations configured with management.oauth_client_secret, exposing credentials to unauthenticated callers when the management plugin and that OAuth configuration are enabled. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6."}, {"lang": "es", "value": "RabbitMQ es un broker de mensajer\u00eda y streaming. Antes de las versiones 3.13.15, 4.0.20, 4.1.11 y 4.2.6, el endpoint obsoleto GET /API/auth puede divulgar el secreto del cliente OAuth 2 en instalaciones de RabbitMQ configuradas con management.oauth_client_secret, exponiendo credenciales a llamadores no autenticados cuando el plugin de gesti\u00f3n y esa configuraci\u00f3n de OAuth est\u00e1n habilitados. Este problema est\u00e1 solucionado en las versiones 3.13.15, 4.0.20, 4.1.11 y 4.2.6."}], "id": "CVE-2026-57219", "lastModified": "2026-10-25T15:10:00.147", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-57219", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-07-16T03:55:25.368000Z", "version": "2.0.3"}}]}, "published": "2026-07-10T21:16:59.060", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/rabbitmq/rabbitmq-server/commit/98b1daf740237c85941e8addcbea6e74f4a2743c"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/rabbitmq/rabbitmq-server/commit/aa387c4451e7b674df3e3ba89df86a99d697cc7f"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/rabbitmq/rabbitmq-server/pull/16083"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/rabbitmq/rabbitmq-server/pull/16086"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-pj24-8j6m-vq9q"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-522"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "RabbitMQ: RabbitMQ: OAuth 2 client secret disclosure via obsolete API endpoint", "id": "2499207", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499207"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-477", "details": ["RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the obsolete GET /api/auth endpoint can disclose the OAuth 2 client secret on RabbitMQ installations configured with management.oauth_client_secret, exposing credentials to unauthenticated callers when the management plugin and that OAuth configuration are enabled. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.", "A flaw was found in RabbitMQ, a messaging and streaming broker. An unauthenticated remote attacker could exploit an obsolete API endpoint (GET /api/auth) to disclose the OAuth 2 client secret. This vulnerability occurs when the RabbitMQ management plugin and OAuth configuration are enabled, leading to unauthorized access to sensitive credentials."], "name": "CVE-2026-57219", "package_state": [{"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "impact": "important", "package_name": "rabbitmq-server4.2", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "impact": "important", "package_name": "rabbitmq-server4.3", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Not affected", "package_name": "rabbitmq-server", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Not affected", "package_name": "rabbitmq-server", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:18.0", "fix_state": "Not affected", "package_name": "rabbitmq-server", "product_name": "Red Hat OpenStack Platform 18.0"}], "public_date": "2026-07-10T20:22:26Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-57219\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-57219\nhttps://github.com/rabbitmq/rabbitmq-server/commit/98b1daf740237c85941e8addcbea6e74f4a2743c\nhttps://github.com/rabbitmq/rabbitmq-server/commit/aa387c4451e7b674df3e3ba89df86a99d697cc7f\nhttps://github.com/rabbitmq/rabbitmq-server/pull/16083\nhttps://github.com/rabbitmq/rabbitmq-server/pull/16086\nhttps://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6\nhttps://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-pj24-8j6m-vq9q"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.2.0,4.2.6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.1.0,4.1.11)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.0.0,4.0.21)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.13.0,3.13.15)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "rabbitmq-server", "source": "cna", "vendor": "rabbitmq"}, "product": "rabbitmq-server", "vendor": "rabbitmq"}], "created": "2026-07-10T21:30:04.142249+00:00", "updated": "2026-08-22T11:00:04.416843+00:00", "vendors": ["rabbitmq", "rabbitmq$PRODUCT$rabbitmq-server"]}