Junglewise Threat Intelligence

CVE-2026-57218: RabbitMQ incorrect authorization for expired OAuth tokens in AMQP 0-9-1

CVE-2026-57218 · Severity: info · CVSS 4.9 · Published 2026-07-10

Vendors: RabbitMQ.

Executive brief

RabbitMQ, a widely used message broker for handling data between applications, contains a flaw in how it manages user permissions. When a user's access rights are reduced or their security token expires, existing connections may continue to receive messages they are no longer authorized to see. This could lead to unauthorized data access if a previously trusted user or application has their permissions revoked but maintains an active connection.

Technical details

An incorrect authorization vulnerability (CWE-863) exists in RabbitMQ's AMQP 0-9-1 implementation. The root cause is that the channel user state changes (such as OAuth token expiry or a secret refresh via connection.update_secret) do not trigger an immediate cancellation or re-authorization of existing consumers. Consequently, a consumer can continue to receive messages from a queue even after its access scopes have been reduced or revoked. The fix, introduced in version 4.2.6, implements a proactive mechanism to clear the permissions cache and re-validate consumer permissions immediately upon a secret change or via a timer-based check.

Affected products

  • rabbitmq rabbitmq-server >= 4.2.0, < 4.2.6

Timeline

  • 2026-04-14: patched: Fixes merged into main and backported to 4.2.x
  • 2026-07-10: advisory: CVE-2026-57218 published

References