/Vulnerability Library

Amazon rabbitmq-aws 0.1.0 through 0.2.0 - Arbitrary File Read

CVE-2026-9133
Verified

Description

Amazon rabbitmq-aws versions 0.1.0 through 0.2.0 contain active debug code in the ARN resolver. An authenticated RabbitMQ user with management API access can submit an arn:aws-debug:file ARN to the validation endpoint and read arbitrary files accessible to the RabbitMQ process.

Severity

High

CVSS Score

7.7

Exploit Probability

1%

Affected Product

rabbitmq-aws

Published Date

August 10, 2026

Template Author

ye11oc4t

CVE-2026-9133.yaml
7.7Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CVE ID:
cve-2026-9133
CWE ID:
cwe-489

References

https://github.com/amazon-mq/rabbitmq-aws/security/advisories/GHSA-8554-wg4r-7hxmhttps://aws.amazon.com/security/security-bulletins/2026-034-aws/https://nvd.nist.gov/vuln/detail/CVE-2026-9133

Remediation Steps

Upgrade rabbitmq-aws to version 0.2.1 or later. If upgrading is not immediately possible, disable the aws plugin and rotate secrets stored in files that the RabbitMQ process could read.