fixnx
highCVE-2026-57219

CVE-2026-57219 in RabbitMQ Server

RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the obsolete GET /api/auth endpoint can disclose the OAuth 2 client secret on RabbitMQ installations configured with management.oauth_client_secret, exposing credentials to...

ProductRabbitMQ Server
CVSS8.7
EPSS0.00359
UpdatedJuly 15, 2026

Quick answer

RabbitMQ Server should be reviewed and updated if it matches the affected versions. The recommended fix is to apply the vendor-supported patched version or the mitigation steps below, then retest the public website with Fixnx.

Who is affected

Affected versions

  • rabbitmq-server >= 4.2.0, < 4.2.6
  • rabbitmq-server >= 4.1.0, < 4.1.11
  • rabbitmq-server >= 4.0.0, < 4.0.21
  • rabbitmq-server >= 3.13.0, < 3.13.15

Fixed versions

  • RabbitMQ Server 3.13.15, 4.0.20, 4.1.11, or 4.2.6

How to fix it

Update RabbitMQ Server. The old server can leak data, skip a permission check, or be slowed down by bad requests.

  1. Back up RabbitMQ config and definitions.
  2. Upgrade RabbitMQ Server to RabbitMQ Server 3.13.15, 4.0.20, 4.1.11, or 4.2.6.
  3. Restart the cluster one node at a time if possible.
  4. Review users, permissions, plugins, and management API access.

Scan now. Google sign-in is only needed to unlock fix guidance.

Verify the fix

  • Run rabbitmq-diagnostics status and confirm the fixed version is installed.
  • Scan again and confirm CVE-2026-57219 is gone.

Related categories

Network SecurityAPI SecurityInformation Disclosure

Trusted references

Source advisoryNVDSource advisoryNVDSource advisoryNVDSource advisoryNVDSource advisoryNVDSource advisoryNVDSource advisoryNVD

FAQ

What is affected by CVE-2026-57219?

RabbitMQ Server versions listed as affected should be reviewed: rabbitmq-server >= 4.2.0, < 4.2.6, rabbitmq-server >= 4.1.0, < 4.1.11, rabbitmq-server >= 4.0.0, < 4.0.21, rabbitmq-server >= 3.13.0, < 3.13.15.

What should I fix first?

Start with internet-facing sites, admin panels, login flows, plugins, themes, modules, packages, and systems that process user-controlled input or sensitive data.

How do I confirm the fix worked?

Apply the patched version or mitigation, clear caches where relevant, retest the affected workflow, and run a new Fixnx scan to verify public website exposure signals.

How are Fixnx security risk categories chosen?

Fixnx keeps one canonical risk page and assigns only broad, relevant categories such as ecosystem, technology area, or vulnerability class.