Executive brief
A vulnerability in the Amazon MQ rabbitmq-aws plugin could allow an authenticated user to read sensitive files from the server. This plugin is used to manage AWS resources and secrets like TLS certificates and passwords for RabbitMQ. An attacker could exploit this to steal private keys or configuration data, potentially leading to further unauthorized access or data breaches.
Technical details
The rabbitmq-aws plugin for RabbitMQ contains active debug code (CWE-489) in its ARN resolver. Specifically, the 'PUT /api/aws/arn/validate' validation endpoint accepts a debug ARN scheme ('arn:aws-debug:file') that was inadvertently included in production builds. An authenticated attacker with management API access can use this scheme to specify local file paths, which the plugin will then read and return. This allows for the disclosure of any file accessible to the RabbitMQ process, including TLS private keys and configuration files. The issue is fixed in version 0.2.1.
Affected products
- Amazon MQ rabbitmq-aws >= 0.1.0, <= 0.2.0
Timeline
- 2026-05-20: disclosed
- 2026-05-20: patched
- 2026-05-20: advisory