This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-57219 →

DEBIAN-CVE-2026-57219

RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the obsolete GET /api/auth endpoint can disclose the OAuth...

Original description

The description as published by the source.

RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the obsolete GET /api/auth endpoint can disclose the OAuth 2 client secret on RabbitMQ installations configured with management.oauth_client_secret, exposing credentials to unauthenticated callers when the management plugin and that OAuth configuration are enabled. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 rabbitmq-server

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 rabbitmq-server

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 rabbitmq-server

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-2"}]}]

References

advisory security-tracker.debian.org