A debug ARN scheme (arn:aws-debug:file) was inadvertently left active in the ARN resolver of the rabbitmq-aws plugin before version 0.2.1. This flaw permits an authenticated user to invoke the PUT /api/aws/arn/validate endpoint and obtain the contents of any file that the RabbitMQ process can read. The result is a confidentiality compromise of potentially sensitive system files, configuration data, or credentials. This weakness corresponds to CWE‑489, which concerns unauthorized data disclosure through improper debug or test code leaving production systems vulnerable.

The vulnerability affects the AWS RabbitMQ (AMQP) plugin provided by Amazon MQ. Any deployment using a version of the rabbitmq-aws component older than 0.2.1 is impacted. The affected product is the Amazon MQ RabbitMQ AWS plugin; updates are available through the Amazon MQ release channels.

The CVSS score of 8.3 indicates high severity, but no EPSS score is available, so the exact likelihood of exploitation is uncertain. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a remote, authenticated user to access the management API endpoint that accepts the debug ARN scheme; thus, an adversary would need legitimate credentials to the RabbitMQ management interface. Once authenticated, the attacker could read arbitrary files on the host. If TLS is used for management connections, rotating private certificate keys is also recommended to mitigate related credential exposure.