CVE-2026-67410
Summary
by MITRE • 09/25/2026
RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.3.3 and 4.2.9, OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint (CWE-200). when OAuth2 authentication is enabled for the RabbitMQ Management UI and the configured flow, IDP use a client secret, the oauthclientsecret configuration value is included in the JavaScript served by the unauthenticated endpoint /js/oidc-oauth/bootstrap.js. Any user who can reach the management UI port can retrieve the OAuth2 client secret without Files: deps/rabbitmqmanagement/src/rabbitmgmtwmauth.erl, line 186 deps/rabbitmqmanagement/src/rabbitmgmtoauthbootstrap.erl, lines 35-50 deps/rabbitmqmanagement/src/rabbitmgmtdispatcher.erl, lines 45-49 (route registration) Code Path: 1. The route /js/oidc-oauth/bootstrap.js is registered as a plain Cowboy handler (rabbitmgmtdispatcher.erl:46): Credential exposure for the affected configuration: OAuth2 client secret is accessible without any authentication Token theft: Attacker can complete the authorization code flow using stolen authorization codes Client impersonation: Attacker can make requests. Any RabbitMQ deployment with: This issue is fixed in versions 4.3.3 and 4.2.9.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/25/2026
RabbitMQ serves as a robust messaging and streaming broker widely deployed in enterprise environments to facilitate communication between distributed systems. A critical security vulnerability was identified within the RabbitMQ Management UI, specifically affecting version ranges from 4.2.0 up to 4.3.3 and 4.2.9 when OAuth2 authentication is enabled with an Identity Provider that utilizes a client secret for authorization flows. This flaw constitutes a severe information disclosure incident classified under CWE-200, which refers to the exposure of sensitive information to unauthorized actors. The root cause lies in the architectural design of the management web interface handlers, where specific JavaScript endpoints were configured without adequate access controls or authentication checks.
The technical mechanism of this vulnerability centers on the endpoint /js/oidc-oauth/bootstrap.js. This resource is registered as a plain Cowboy handler within the RabbitMQ management dispatcher logic, specifically referenced in source files such as rabbitmgmtdispatcher.erl and rabbitmgmtwmauth.erl. When an administrator configures OAuth2 authentication for the Management UI using an Identity Provider that requires a client secret, this sensitive credential is embedded directly into the JavaScript code served by the aforementioned endpoint. Crucially, this endpoint does not require any form of user authentication or session validation to be accessed. Consequently, any network entity capable of reaching the RabbitMQ management port can retrieve the raw source code containing the plaintext OAuth2 client secret without prior authorization.
The operational impact of exposing the OAuth2 client secret is profound and multifaceted. First, it enables credential theft where an attacker gains access to a high-value secret used for authenticating applications or services against the Identity Provider. With this secret, combined with stolen authorization codes obtained through phishing or other social engineering attacks, an adversary can complete the OAuth2 authorization code flow. This allows them to exchange these codes for valid access tokens, effectively impersonating legitimate users or clients within the RabbitMQ ecosystem. Furthermore, possession of the client secret permits client impersonation at a broader level, allowing attackers to make authenticated requests to external services protected by the same Identity Provider configuration, potentially leading to further lateral movement and data exfiltration beyond just the messaging broker itself.
This vulnerability aligns with ATT&CK technique T1539, which involves stealing web session cookies or credentials from browser storage, although in this specific case, it is a direct exposure of static configuration secrets rather than dynamic session tokens. It also relates to CWE-798, use of hardcoded credentials, as the secret becomes part of the client-side codebase exposed via HTTP. The lack of authentication on an endpoint serving sensitive cryptographic material represents a fundamental failure in access control principles and secure by design practices for web-based management interfaces.
To mitigate this risk, organizations running affected versions must upgrade immediately to RabbitMQ version 4.3.3 or later, which includes the necessary patches to prevent the exposure of OAuth2 client secrets via unauthenticated endpoints. Until an upgrade is feasible, administrators should ensure that the RabbitMQ Management UI port is not exposed to untrusted networks and restrict access using firewalls or reverse proxies with strict IP whitelisting. Additionally, rotating any compromised credentials associated with the affected OAuth2 configuration is imperative if there is evidence of unauthorized access during the window when the vulnerability was present in production environments.