RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the obsolete GET /api/auth endpoint can disclose the OAuth 2 client secret on RabbitMQ installations configured with management.oauth_client_secret, exposing credentials to unauthenticated callers when the management plugin and that OAuth configuration are enabled. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.
Fix
Patch, vendor advisory and mitigation references on NVD 5
- https://github.com/rabbitmq/rabbitmq-server/commit/98b1daf740237c85941e8addcbea6e74f4a2743c Patch
- https://github.com/rabbitmq/rabbitmq-server/commit/aa387c4451e7b674df3e3ba89df86a99d697cc7f Patch
- https://github.com/rabbitmq/rabbitmq-server/pull/16083 Issue Tracking, Patch
- https://github.com/rabbitmq/rabbitmq-server/pull/16086 Issue Tracking, Patch
- https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-pj24-8j6m-vq9q Mitigation, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 8.7 · broadcomNVD modified 2026-10-25 15:10
Affected (CPE criteria) 1
cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*
References 6
- https://github.com/rabbitmq/rabbitmq-server/commit/98b1daf740237c85941e8addcbea6e74f4a2743c Patch
- https://github.com/rabbitmq/rabbitmq-server/commit/aa387c4451e7b674df3e3ba89df86a99d697cc7f Patch
- https://github.com/rabbitmq/rabbitmq-server/pull/16083 Issue Tracking, Patch
- https://github.com/rabbitmq/rabbitmq-server/pull/16086 Issue Tracking, Patch
- https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6 Release Notes
- https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-pj24-8j6m-vq9q Mitigation, Vendor Advisory