CVE-2026-67410

Name of the Vulnerable Software and Affected Versions RabbitMQ versions 4.2.0 through 4.2.8 RabbitMQ versions 4.3.0 through 4.3.2

Description An information exposure occurs when OAuth2 authentication is enabled for the RabbitMQ Management UI and the configured Identity Provider (IDP) uses a client secret. The oauthclientsecret configuration value is included in the JavaScript served by the unauthenticated endpoint '/js/oidc-oauth/bootstrap.js'. An attacker with access to the management UI port can retrieve this secret, potentially leading to token theft by completing the authorization code flow or client impersonation to make unauthorized requests.

Recommendations Update to version 4.2.9. Update to version 4.3.3.