Description
RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.3.3 and 4.2.9, OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint (CWE-200). when OAuth2 authentication is enabled for the RabbitMQ Management UI and the configured flow, IDP use a client secret, the oauthclientsecret configuration value is included in the JavaScript served by the unauthenticated endpoint /js/oidc-oauth/bootstrap.js. Any user who can reach the management UI port can retrieve the OAuth2 client secret without Files: deps/rabbitmqmanagement/src/rabbitmgmtwmauth.erl, line 186 deps/rabbitmqmanagement/src/rabbitmgmtoauthbootstrap.erl, lines 35-50 deps/rabbitmqmanagement/src/rabbitmgmtdispatcher.erl, lines 45-49 (route registration) Code Path: 1. The route /js/oidc-oauth/bootstrap.js is registered as a plain Cowboy handler (rabbitmgmtdispatcher.erl:46): Credential exposure for the affected configuration: OAuth2 client secret is accessible without any authentication Token theft: Attacker can complete the authorization code flow using stolen authorization codes Client impersonation: Attacker can make requests. Any RabbitMQ deployment with: This issue is fixed in versions 4.3.3 and 4.2.9.
Published: 2026-09-25
Score: 8.2 High
EPSS: < 1% Very Low
KEV: No
Impact: Credential Exposure
Action: Patch Immediately
AI Analysis

Impact

This vulnerability allows an unauthenticated user who can reach the RabbitMQ Management UI port to download a JavaScript file that includes the OAuth2 client secret in plaintext. The exposed secret can be used in the OAuth2 authorization code flow to obtain access tokens, allowing an attacker to impersonate the client application and access protected resources. The weakness is a credential leakage scenario (CWE-200).

Affected Systems

RabbitMQ is affected in server versions 4.2.0 through 4.2.8 and 4.3.0 through 4.3.2. Versions 4.2.9 and 4.3.3 contain the fix and are no longer vulnerable.

Risk and Exploitability

The CVSS score is 8.2, indicating high severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote, relying on an unauthenticated HTTP request to the /js/oidc-oauth/bootstrap.js endpoint served by the management UI. Because the endpoint is publicly accessible to any user who can reach the management port, the threat remains high in environments where the management UI is exposed to untrusted networks.

Generated by OpenCVE AI on September 25, 2026 at 18:25 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade RabbitMQ to at least version 4.3.3 or 4.2.9 to apply the fix.
  • If an immediate upgrade is not possible, restrict access to the management UI port (15672) to trusted internal networks only or disable external connectivity to that port.
  • As a temporary workaround, disable OAuth2 authentication for the RabbitMQ Management UI until the patch can be applied.

Generated by OpenCVE AI on September 25, 2026 at 18:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 08 Oct 2026 16:00:00 +0000

Type Values Removed Values Added
First Time appeared Broadcom
Broadcom rabbitmq Server
CPEs cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*
Vendors & Products Broadcom
Broadcom rabbitmq Server
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N'}

Sat, 26 Sep 2026 11:30:00 +0000

Type Values Removed Values Added
First Time appeared Rabbitmq
Rabbitmq rabbitmq-server
Vendors & Products Rabbitmq
Rabbitmq rabbitmq-server

Fri, 25 Sep 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 25 Sep 2026 16:45:00 +0000

Type Values Removed Values Added
Description RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.3.3 and 4.2.9, OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint (CWE-200). when OAuth2 authentication is enabled for the RabbitMQ Management UI and the configured flow, IDP use a client secret, the oauthclientsecret configuration value is included in the JavaScript served by the unauthenticated endpoint /js/oidc-oauth/bootstrap.js. Any user who can reach the management UI port can retrieve the OAuth2 client secret without Files: deps/rabbitmqmanagement/src/rabbitmgmtwmauth.erl, line 186 deps/rabbitmqmanagement/src/rabbitmgmtoauthbootstrap.erl, lines 35-50 deps/rabbitmqmanagement/src/rabbitmgmtdispatcher.erl, lines 45-49 (route registration) Code Path: 1. The route /js/oidc-oauth/bootstrap.js is registered as a plain Cowboy handler (rabbitmgmtdispatcher.erl:46): Credential exposure for the affected configuration: OAuth2 client secret is accessible without any authentication Token theft: Attacker can complete the authorization code flow using stolen authorization codes Client impersonation: Attacker can make requests. Any RabbitMQ deployment with: This issue is fixed in versions 4.3.3 and 4.2.9.
Title RabbitMQ: OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint
Weaknesses CWE-200
References
Metrics cvssV4_0

{'score': 8.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Broadcom Rabbitmq Server
Rabbitmq Rabbitmq-server
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-25T17:46:42.745Z

Reserved: 2026-07-29T15:02:20.412Z

Link: CVE-2026-67410

cve-icon Vulnrichment

Updated: 2026-09-25T17:46:10.811Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-25T17:17:13.093

Modified: 2026-10-08T15:43:35.610

Link: CVE-2026-67410

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-26T11:15:10Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor