RabbitMQ STOMP consumers retain OAuth queue access after JWT expiration
概要
Advisory Details
Title: RabbitMQ STOMP consumers retain OAuth queue access after JWT expiration
Description:
Summary
RabbitMQ's native STOMP adapter does not terminate an authenticated consumer when the OAuth JWT used for CONNECT expires. A client that subscribes while...
影響パッケージ
| 種類 | パッケージ | 影響を受ける版 | 直った版 |
|---|---|---|---|
| rabbitmq | rabbitmq-server |
>= 4.3.0, < 4.3.6 |
4.3.6 |
| rabbitmq | rabbitmq-server |
>= 4.2.0, < 4.2.11 |
4.2.11 |
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。
Advisory Details
Title: RabbitMQ STOMP consumers retain OAuth queue access after JWT expiration
Description:
Summary
RabbitMQ's native STOMP adapter does not terminate an authenticated consumer when the OAuth JWT used for CONNECT expires. A client that subscribes while the token is valid can continue receiving new queue messages after the same token is rejected for a fresh connection. This defeats token-lifetime enforcement and can expose post-expiry message payloads.
Details
The highest affected GitHub release is v4.3.2, published on June 15, 2026. Its canonical upstream commit is a509158b1b1e21c892a7f1dacbe0d158076dc7b8.
In v4.3.2, rabbit_stomp_processor:process_connect/3 takes the STOMP CONNECT login and passcode and passes them to do_login/7. do_login/7 opens and stores a direct AMQP connection/channel for the STOMP session. It starts STOMP heartbeat handling, but it does not obtain rabbit_access_control:expiry_timestamp/1 and does not schedule a credential-expiry event.
The STOMP reader schedules only login_timeout. Once rabbit_stomp_processor:info(channel, ProcState) is no longer none, that timeout handler returns without installing any follow-up expiry timer. Existing subscriptions are then created with amqp_channel:subscribe/3, and send_delivery/5 serializes deliveries as STOMP MESSAGE frames without a post-expiry authorization barrier.
%% rabbit_stomp_reader.erl in v4.3.2
LoginTimeout = application:…
出典: GitHub Repository Security Advisories (Game のスタック) GitHub Advisory OSV
参照URL
- GITHUB_REPO_ADVISORY rabbitmq/rabbitmq-server